0c801ad406
[AUTOPATCHER-CORE] Upgrade clamav to 1.0.7 CVE-2024-20505, CVE-2024-20506 ( #11145 )
...
Co-authored-by: Tobias Brick <tobiasb@microsoft.com>
(cherry picked from commit 29129216e9
2024-11-20 19:50:38 +00:00
9ddedd6dfe
[2.0] Upgrade nvidia container toolkit and libnvidia-containers to v1.17.1 ( #11011 )
...
Co-authored-by: Henry Li <lihl@microsoft.com>
2024-11-18 10:28:03 -08:00
5db0430272
Add merge conflict github PR check ( #10930 )
2024-11-14 16:37:10 -08:00
1eabecd7f0
[AUTO-CHERRYPICK] glib: Fix for CVE-2024-52533 - branch main ( #11076 )
...
Co-authored-by: sharath-srikanth-chellappa <115591284+sharath-srikanth-chellappa@users.noreply.github.com>
2024-11-14 14:57:52 -05:00
18f353865b
Added the 2.0 fast-track merge notifier pipeline. ( #11034 )
2024-11-14 11:25:09 -08:00
1f6055083a
Patch CVE-2024-49767 in python-werkzeug ( #10949 )
...
Co-authored-by: Suresh Thelkar <sthelkar@microsoft.com>
2024-11-14 10:47:33 -05:00
675046589e
[AUTO-CHERRYPICK] ruby and rubygem-rexml: patch CVE-2024-49761 - branch main ( #10970 )
...
Co-authored-by: Saul Paredes <30801614+Redent0r@users.noreply.github.com>
2024-11-12 12:00:18 -08:00
c3874f8d8d
[AUTO-CHERRYPICK] Fix CVE-2024-50602 in expat - branch main ( #10937 )
...
Co-authored-by: sindhu-karri <33163197+sindhu-karri@users.noreply.github.com>
Co-authored-by: Andrew Phelps <anphel31@users.noreply.github.com>
2024-11-12 11:59:39 -08:00
332f415363
[AUTO-CHERRYPICK] Patched CVE-2024-2410 in `mysql`. - branch main ( #10938 )
...
Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
2024-11-12 11:58:43 -08:00
e946d81713
[AUTO-CHERRYPICK] Fix multiple CVEs in Skopeo - branch main ( #11030 )
...
Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>
2024-11-12 14:58:01 -05:00
2d5be945cc
[AUTO-CHERRYPICK] [2.0] prometheus address CVE-2023-39325 CVE-2023-45288 - branch main ( #10971 )
...
Co-authored-by: nicolas guibourge <nicogbg@gmail.com>
2024-11-12 11:57:26 -08:00
5623842af3
cloud-hypervisor-cvm: add upstream patch to work around lack of support for extended guest requests ( #10335 )
...
Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2024-11-11 12:27:54 -06:00
446a8bbdfc
file: address CVE-2022-48554 ( #10781 )
...
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>
2024-11-06 08:25:49 -05:00
312a3332f4
[AUTOPATCHER-CORE] Upgrade mariadb to 10.6.20 none ( #10927 )
2024-11-05 17:02:18 -05:00
8945822707
Address CVE-2022-47007, CVE-2022-47008, CVE-2022-47010, CVE-2022-47011 ( #10926 )
...
Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>
2024-11-05 17:01:33 -05:00
6f9f59506e
Avahi: Fix CVE-2023-1981, add %check section ( #10881 )
2024-10-31 11:30:50 -07:00
dc348a815d
Upgraded vim to 9.1.0791 to fix several CVEs ( #10777 )
...
Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>
2024-10-29 09:20:06 -04:00
3eb66d1e29
[AUTO-CHERRYPICK] [AUTOPATCHER-CORE] Upgrade msft-golang to 1.22.8 To fix CVE-2022-41717 - branch main ( #10834 )
2024-10-25 14:41:49 -04:00
4401d89fad
[AUTO-CHERRYPICK] Added Patch CVE-2022-25255 for qt5-qtbase - branch main ( #10835 )
...
Co-authored-by: Mykhailo Bykhovtsev <108374904+mbykhovtsev-ms@users.noreply.github.com>
2024-10-25 14:41:25 -04:00
4dd3ddf0b0
[AUTO-CHERRYPICK] Upgrade mysql to 8.0.40 - branch main ( #10809 )
...
Co-authored-by: Sudipta Pandit <sudpandit@microsoft.com>
2024-10-25 14:40:38 -04:00
7f7a3b897b
Prepare November 2024 ( #10845 )
2024-10-25 08:50:34 -04:00
c5b6704f80
Remove Amateur Radio X.25 PLP Rose for CVE-2022-2961 ( #10826 )
...
The rose_bind() function which is used in the AX.25 PLP Rose protocol introduced a race condition which has CVE-2022-2961. Therefore remove rose support.
2024-10-24 14:40:32 -07:00
1729e7544b
[AUTO-CHERRYPICK] Patch Reaper for multiple CVEs - branch main ( #10735 )
...
Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>
Co-authored-by: Riken Maharjan <rmaharjan@microsoft.com>
2024-10-23 11:47:18 -07:00
b958bee0c4
curl: address CVE-2024-8096 ( #10731 )
...
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2024-10-23 11:40:11 +05:30
60d78f8b22
nghttp2: address CVE-2024-28182 ( #10656 )
...
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2024-10-23 09:18:37 +05:30
2ab7767a79
gnutls: upgrade 3.7.7 -> 3.7.11 to address CVE-2023-5981, CVE-2024-28835, CVE-2024-28834 & CVE-2024-0553 ( #10578 )
...
Changelog: https://gitlab.com/gnutls/gnutls/-/blob/3.7.11/NEWS
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2024-10-23 09:16:25 +05:30
db8338b9b1
apr: upgrade version 1.7.2 -> 1.7.5 to address CVE-2023-49582 ( #10749 )
...
Changelog: https://downloads.apache.org/apr/CHANGES-APR-1.7
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2024-10-23 09:07:02 +05:30
08e99cef68
Patch gdb 11.2 for CVE-2023-39128, CVE-2023-39129, CVE-2023-39130 ( #10683 )
2024-10-22 13:13:48 -07:00
78c1dd1dc9
[AUTOPATCHER-CORE] Upgrade php to 8.1.30 CVE-2024-8927, CVE-2024-8925 ( #10795 )
2024-10-22 12:06:02 +05:30
8f60da79d4
rubygem-async-http: remove version dependency of rubygem-protocol-http1 ( #10682 )
...
Co-authored-by: Dallas Delaney <dadelan@example.com>
2024-10-21 18:02:58 -07:00
9cc3b9949b
libpcap: Backport fixes for CVE-2024-8006 ( #10793 )
2024-10-22 02:04:46 +05:30
8b11ebddc9
Upgrade redis to 6.2.16 ( #10798 )
2024-10-22 02:03:49 +05:30
770cf87559
fluent-bit: CVE-2024-26455, CVE-2024-25629 ( #10739 )
2024-10-21 12:09:50 -07:00
fece1b0dd3
[2.0] Resolve kubernetes CVE-2024-24786 ( #10669 )
...
Co-authored-by: Henry Li <lihl@microsoft.com>
2024-10-18 14:02:58 -07:00
95c646c8e7
[AUTO-CHERRYPICK] Patch vim to resolve CVE-2024-43802 - branch main ( #10771 )
...
Co-authored-by: Sam Meluch <109628994+sameluch@users.noreply.github.com>
2024-10-18 15:31:55 -04:00
cdd7571aab
[AUTO-CHERRYPICK] libarchive: Patch CVE-2024-48957, CVE-2024-48958, CVE-2024-20696 - branch main ( #10770 )
...
Co-authored-by: Nan Liu <108544011+liunan-ms@users.noreply.github.com>
2024-10-18 15:31:34 -04:00
054eed9904
[AUTO-CHERRYPICK] Patch terraform to resolve CVE-2022-32149 & CVE-2023-4782 - branch main ( #10755 )
...
Co-authored-by: Sumedh Alok Sharma <sumsharma@microsoft.com>
2024-10-18 15:30:59 -04:00
f43a558e8d
[AUTO-CHERRYPICK] Fix CVE 2024 24786 and CVE 2022 41717 for prometheus - branch main ( #10737 )
...
Co-authored-by: bhagyapathak <bhagyapathak@users.noreply.github.com>
2024-10-18 15:30:42 -04:00
f7e825f60a
[AUTO-CHERRYPICK] Apply security fix for CVE-2024-28180 by patching vendored go-jose - branch main ( #10736 )
...
Co-authored-by: abadawi-msft <108105696+abadawi591@users.noreply.github.com>
2024-10-18 15:30:21 -04:00
e88c36d034
[AUTO-CHERRYPICK] Upgrade OpenIPMI to 2.0.36 to fix CVE-2024-42934 - branch main ( #10734 )
...
Co-authored-by: suresh-thelkar <suresh.thelkar@yahoo.com>
2024-10-18 14:55:10 -04:00
a41e552a4e
[AUTO-CHERRYPICK] Patch CVE-2022-28506 and CVE-2023-48161 in giflib - branch main ( #10733 )
...
Co-authored-by: suresh-thelkar <suresh.thelkar@yahoo.com>
2024-10-18 14:54:26 -04:00
6cc144262e
[AUTO-CHERRYPICK] Patch CVE-2024-31449 in redis - branch main ( #10732 )
...
Co-authored-by: suresh-thelkar <suresh.thelkar@yahoo.com>
2024-10-18 14:53:39 -04:00
4517ec0599
Fix CVE-2024-47554 for apache-commons-io ( #10708 )
2024-10-15 11:30:40 +05:30
ca21053edc
Patch cni-plugins to resolve CVE-2023-3978 ( #10689 )
2024-10-15 11:16:33 +05:30
10ccf03d75
[2.0] Resolve kubernetes CVE-2024-28180 ( #10668 )
...
Co-authored-by: Henry Li <lihl@microsoft.com>
2024-10-14 22:20:02 -07:00
d97b713262
[2.0] Resolve dcos-cli CVE-2024-28180 ( #10667 )
...
Co-authored-by: Henry Li <lihl@microsoft.com>
2024-10-14 22:19:37 -07:00
d3b1c72ca5
[AUTO-CHERRYPICK] Patch unbound to fix CVE-2024-33655, CVE-2024-8508, and CVE-2024-43167 - branch main ( #10674 )
...
Co-authored-by: Sam Meluch <109628994+sameluch@users.noreply.github.com>
2024-10-10 14:48:13 -07:00
7b9cd9b10c
gh: address CVE-2022-32149 ( #10334 )
...
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2024-10-10 15:01:50 +05:30
9e55d13d8b
[AUTO-CHERRYPICK] [AUTOPATCHER-CORE] Upgrade nvidia-container-toolkit to 1.16.2 Critical vulnerability CVE-2024-0132, Medium vulnerability CVE-2024-0133 - branch main ( #10660 )
2024-10-09 13:50:37 -07:00
6d7ba8b546
[AUTO-CHERRYPICK] Fix CVE-2024-47191 in oath-toolkit - branch main ( #10650 )
...
Co-authored-by: Mandeep Plaha <99760213+mandeepsplaha@users.noreply.github.com>
2024-10-09 13:50:18 -07:00
CBL-Mariner-Bot
Henry Li
Mykhailo Bykhovtsev
Pawel Winogrodzki
suresh-thelkar
Aurélien Bombo
Muhammad Falak R Wani
nicolas guibourge
Daniel McIlvaney
Nick Samson
Rachel Menge
Mitch Zhu
Dallas Delaney
Sudipta Pandit
Chris Gunn
bhagyapathak
Sumedh Alok Sharma