CVE-2022-1941

Advisory

Kfp-tekton 1.4.0 updates its dependency 'protobuf' to v3.20.3 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* Tekton 0.38.4 support to handle Tekton graph validation degradation issues (1049, 1051)
* Default timeout global values changed to 0 and generated pipelinerun yaml no longer producing default timeout values (1042, 1043)
* New sequential loop output parameters last_idx and last_elem to retrieved last iterated value (1044)
* Add iterateParamPassStyle and itemPassStyle params to loop (1059)
* Add new annotation flags to enable artifact tracking at pipeline and task level (1065)
* Optimized KFP-Tekton deployment and generated yaml (1038, 1055, 1062)
* Improved custom task caching to also aware of input parameters (1056)

What's Changed
* fix(sdk) include finally tasks in placeholder indir by Udiknedormin in https://github.com/kubeflow/kfp-tekton/pull/1035
* Add finally context var test case for 1035 by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1036
* do not mark failed until all running PRs are done by wzhanw in https://github.com/kubeflow/kfp-tekton/pull/1037
* optimize(sdk): Further moving common caching annotations to pipeline level by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1038
* fix(backend): add check for casting by yhwang in https://github.com/kubeflow/kfp-tekton/pull/1040
* Update tekton default timeout in global config by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1042
* feat(backend): handle pipelineloop status by yhwang in https://github.com/kubeflow/kfp-tekton/pull/1039
* feat(sdk): Remove timeout since we moved to default unlimited timeout by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1043
* fix(sdk): Fix nested numeric parameters by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1047
* fix(backend): Update Tekton to 0.38.4 by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1049
* feat(pipelineloop): Support last_idx and last_elem by ScrapCodes in https://github.com/kubeflow/kfp-tekton/pull/1044
* test: Add a test case for the validation by yhwang in https://github.com/kubeflow/kfp-tekton/pull/1051
* Update kfp-sdk to 1.8.14 by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1050
* feature(backend): Add QPS and Burst settings by yhwang in https://github.com/kubeflow/kfp-tekton/pull/1055
* fix(manifests): Patch cache config and break ct to default pl deployment by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1057
* feat(sdk): add custom task param support in command spec by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1061
* feat(sdk): add iterateParamPassStyle and itemPassStyle params to loop by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1059
* chore(sdk): Remove unnecessary code by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1062
* fix(pipelineloop): caching should include the params for making caching key. by ScrapCodes in https://github.com/kubeflow/kfp-tekton/pull/1056
* fix(sdk): update loop dsl to handle same argument in nested loop by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1052
* chore(release): add 1.4.0 release changes by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1063
* chore(OWNERS): Remove Animesh as reviewer by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1064
* feat(backend): add new annotation flags to enable artifact tracking at pipeline and task level by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1065
* fix(sdk): update python protobuf package for security update by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1066
* chore(docs): Move loop to custom feature since it's not Tekton native by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1067


**Full Changelog**: https://github.com/kubeflow/kfp-tekton/compare/v1.3.1...v1.4.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1941