CVE-2023-37264

Advisory

Kfp-tekton 1.9.0 updates the dependency Tekton 0.50.2 to fix regression and security bugs.
https://github.com/kubeflow/kfp-tekton/pull/1382/commits/1ec9fe60c567037389d0ccf16a20cce8a5d59c2a

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Tekton 0.53.2 support
- Moved V2 custom task controllers to master branch. Merged driver tasks into kfptask.
- Going forward we have the master branch maintaining all V2 custom task controller and Tekton compiler/execution code. Master branch will continue for bug fixes on the V1 code base. Current KFP-Tekton V2 development is inside the v2-integration branch but will decouple it into packages that can be maintained inside master branch.
- Bugs fixes for KFP-Tekton V1 step injections.

What's Changed
* chore(docs): Add grpc gateway version to user guides. by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1346
* fix(docs) Update Kind install command to use kubectl -k by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1348
* fix(sdk): Fix nested loop with cel outputs by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1351
* fix(manifests): Update istio-authorization-config.yaml for multi-user by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1362
* chore(docs): Update kfp_tekton_install.md with kfp-tekton v2 install instructions by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1367
* chore(docs): Add SECURITY.md to tell supporting kfp-tekton version by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1368
* feat(tekton-catalog): Move v2 tekton-exithandler custom task to tekton catalog by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1370
* chore(cleanup): remove old manifests and tools to reduce security checklist by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1371
* chore(deps): bump urllib3 from 1.26.15 to 1.26.17 in /sdk/python by dependabot in https://github.com/kubeflow/kfp-tekton/pull/1356
* chore(deps): bump certifi from 2022.12.7 to 2023.7.22 in /sdk/python by dependabot in https://github.com/kubeflow/kfp-tekton/pull/1372
* feat(tekton-catalog): Add V2 Tekton kfptask to Tekton catalog by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1373
* chore(deps): Fix golang.org/x/net vulnerability by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1377
* chore(github): Update github action deps by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1383
* fix(deps): Update to Tekton 0.50.2 to fix regression and security bugs by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1382
* chore(release): Add kfp-tekton 1.8.1 release by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1385
* feat(Tekton CI): add v2 ci image publish pipeline tasks by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1386
* chore(docs): update manual release process and minor ci display name change by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1387
* chore(deps): bump urllib3 from 1.26.17 to 1.26.18 in /sdk/python by dependabot in https://github.com/kubeflow/kfp-tekton/pull/1388
* fix(tekton-catalog): fix kfptask custom task by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1389
* feat(tekton-catalog): Move kfp-tekton v2 driver to master branch by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1391
* chore(docs): Update main readme entrypoint by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1393
* feat(backend): Add CA injection to step-copy-artifacts step. Fixes 1394. by HumairAK in https://github.com/kubeflow/kfp-tekton/pull/1395
* chore(docs): Update kfp-tekton install versions by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1397
* chore(deps): update golang grpc deps to 1.56.3 by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1404
* fix(tekton-catalog): sync pipeline package to 2.0.3 release by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1405
* feat(tekton-catalog): merge driver and kfptask into one controller by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1411
* chore(docs): Update kfp-tekton v2 version in the docs by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1413
* chore(docs): Update v2 dev branch version in main readme by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1414
* chore(ci): remove driver build code since it is no longer necessary by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1418
* chore(backend): update to tekton 0.53.2 by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1420
* chore(release): Add kfp-tekton 1.9.0 release by Tomcli in https://github.com/kubeflow/kfp-tekton/pull/1422

New Contributors
* dependabot made their first contribution in https://github.com/kubeflow/kfp-tekton/pull/1356

**Full Changelog**: https://github.com/kubeflow/kfp-tekton/compare/v1.8.0...v1.9.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37264