Bug 917614

Summary:	<app-admin/consul-1.15.7: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	minor	CC:	ultrabug, zmedico
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/hashicorp/consul/releases/tag/v1.15.7
Whiteboard:	B3 [stable?]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	915553

Description John Helmert III archtester

2023-11-20 03:17:03 UTC

Couple of dependency updates to handle here it seems:

"* Upgrade `google.golang.org/grpc` to 1.56.3.
This resolves vulnerability [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). [[GH-19414](https://github.com/hashicorp/consul/issues/19414)]
* connect: update supported envoy versions to 1.24.12, 1.25.11 to address [CVE-2023-44487](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76) [[GH-19272](https://github.com/hashicorp/consul/issues/19272)]"

Please bump to 1.15.7.

Comment 1 Larry the Git Cow gentoo-dev

2023-11-20 04:38:00 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c2dcff5d23df3ca5f6e60283ccc286571bf66c0a

commit c2dcff5d23df3ca5f6e60283ccc286571bf66c0a
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2023-11-20 04:36:24 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2023-11-20 04:37:56 +0000

    app-admin/consul: add 1.15.7
    
    Bug: https://bugs.gentoo.org/917614
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 app-admin/consul/Manifest             |  1 +
 app-admin/consul/consul-1.15.7.ebuild | 57 +++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+)

Comment 2 John Helmert III archtester

2023-11-21 03:58:26 UTC

Thanks! Please stabilize when ready.