Skip to content

Commit

Permalink
Updating
Browse files Browse the repository at this point in the history
Signed-off-by: A.Arnold <anarnold@redhat.com>
  • Loading branch information
anarnold97 committed Apr 25, 2024
1 parent 972b0de commit 5c11724
Showing 1 changed file with 15 additions and 5 deletions.
20 changes: 15 additions & 5 deletions modules/migration-mtc-release-notes-1-7-15.adoc
Expand Up @@ -5,31 +5,41 @@
[id="migration-mtc-release-notes-1-7-15_{context}"]
= {mtc-full} 1.7.15 release notes


[id="resolved-issues-1-7-15_{context}"]
== Resolved issues

This release has the following resolved issues:

.CVE-2024-24786: A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop

A flaw was found in the `protojson.Unmarshal` function, which could enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition could occur when unmarshaling into a message which contained a `google.protobuf.Any` value, or when the `UnmarshalOptions.DiscardUnknown` option was set.
A flaw was found in the `protojson.Unmarshal` function, which could enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition could occur when unmarshaling into a message that contained a `google.protobuf.Any` value or when the `UnmarshalOptions.DiscardUnknown` option was set.

To resolve this issue, upgrade to {mtc-short} 1.7.15.

For more details, see link:https://access.redhat.com/security/cve/CVE-2024-24786[(CVE-2024-24786)]
For more details, see link:https://access.redhat.com/security/cve/CVE-2024-24786[(CVE-2024-24786)].

.CVE-2024-28180: `jose-go` improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. An attacker could send a JSON Web Encryption (JWE) containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. 

To resolve this issue, upgrade to {mtc-short} 1.7.15.

For more details, see link:https://access.redhat.com/security/cve/CVE-2024-28180[(CVE-2024-28180)]

For more details, see link:https://access.redhat.com/security/cve/CVE-2024-28180[(CVE-2024-28180)].


[id="known-issues-1-7-15_{context}"]
== Known issues

This release has the following known issues:

.Direct Volume Migration is failing as the rsync pod on the source cluster goes into an `Error` state

On migrating any application with Persistent Volume Claim (PVC), Stage succeeds with warnings and Direct Volume Migration (DVM) fails with the `rsync` pod on the source namespace going into an `error` state. link:https://bugzilla.redhat.com/show_bug.cgi?id=2256141[(BZ#2256141)]

.The conflict condition is briefly cleared after it is created

When creating a new state migration plan that will result in a conflict error, that error is cleared shortly after it is displayed. link:https://bugzilla.redhat.com/show_bug.cgi?id=2144299[(BZ#2144299)]

.Migration fails when there are multiple Volume Snapshot Locations (VSLs) of different provider types configured in a cluster and no default VSL is set

When there are multiple VSLs in a cluster with different provider types, and none of them is set as default, Velero results in a validation error, making migrations fail. link:https://bugzilla.redhat.com/show_bug.cgi?id=2180565[(BZ#2180565)]

0 comments on commit 5c11724

Please sign in to comment.