luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

connect: Bump Envoy 1.20 to 1.20.7, 1.21 to 1.21.5 and 1.22 to 1.22.5 (#14831)

This commit is contained in:
Evan Culver 2022-10-04 13:15:01 -07:00 committed by GitHub
parent d54966effc
commit 42423ffce2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.changelog/14831.txt Normal file
View File

@ -0,0 +1,3 @@
```release-note:improvement
connect: Bump Envoy 1.20 to 1.20.7, 1.21 to 1.21.5 and 1.22 to 1.22.5
```

6
.circleci/config.yml
View File

@ -24,9 +24,9 @@ references:
VAULT_BINARY_VERSION: 1.9.4 VAULT_BINARY_VERSION: 1.9.4
GO_VERSION: 1.18.1 GO_VERSION: 1.18.1
envoy-versions: &supported_envoy_versions envoy-versions: &supported_envoy_versions
- &default_envoy_version "1.20.6" - &default_envoy_version "1.20.7"
- "1.21.4" - "1.21.5"
- "1.22.2" - "1.22.5"
- "1.23.1" - "1.23.1"
nomad-versions: &supported_nomad_versions nomad-versions: &supported_nomad_versions
- &default_nomad_version "1.3.3" - &default_nomad_version "1.3.3"

6
agent/xds/envoy_versioning_test.go
View File

@ -135,9 +135,9 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
} }
*/ */
for _, v := range []string{ for _, v := range []string{
"1.20.0", "1.20.1", "1.20.2", "1.20.3", "1.20.4", "1.20.5", "1.20.6", "1.20.0", "1.20.1", "1.20.2", "1.20.3", "1.20.4", "1.20.5", "1.20.6", "1.20.7",
"1.21.0", "1.21.1", "1.21.2", "1.21.3", "1.21.4", "1.21.0", "1.21.1", "1.21.2", "1.21.3", "1.21.4", "1.21.5",
"1.22.0", "1.22.1", "1.22.2", "1.22.0", "1.22.1", "1.22.2", "1.22.3", "1.22.4", "1.22.5",
"1.23.0", "1.23.1", "1.23.0", "1.23.1",
} { } {
cases[v] = testcase{expect: supportedProxyFeatures{}} cases[v] = testcase{expect: supportedProxyFeatures{}}

6
agent/xds/proxysupport/proxysupport.go
View File

@ -8,7 +8,7 @@ package proxysupport
// see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
var EnvoyVersions = []string{ var EnvoyVersions = []string{
"1.23.1", "1.23.1",
"1.22.2", "1.22.5",
"1.21.4", "1.21.5",
"1.20.6", "1.20.7",
} }

6
website/content/docs/connect/proxies/envoy.mdx
View File

@ -39,9 +39,9 @@ Consul supports **four major Envoy releases** at the beginning of each major Con
| Consul Version | Compatible Envoy Versions | | Consul Version | Compatible Envoy Versions |
| ------------------- | -----------------------------------------------------------------------------------| | ------------------- | -----------------------------------------------------------------------------------|
| 1.13.x | 1.23.1, 1.22.2, 1.21.4, 1.20.6 | | 1.13.x | 1.23.1, 1.22.5, 1.21.5, 1.20.7 |
| 1.12.x | 1.22.2, 1.21.4, 1.20.6, 1.19.5 | | 1.12.x | 1.22.5, 1.21.5, 1.20.7, 1.19.5 |
| 1.11.x | 1.20.6, 1.19.5, 1.18.6, 1.17.4<sup>1</sup> | | 1.11.x | 1.20.7, 1.19.5, 1.18.6, 1.17.4<sup>1</sup> |
1. Envoy 1.20.1 and earlier are vulnerable to [CVE-2022-21654](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21654) and [CVE-2022-21655](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21655). Both CVEs were patched in Envoy versions 1.18.6, 1.19.3, and 1.20.2. 1. Envoy 1.20.1 and earlier are vulnerable to [CVE-2022-21654](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21654) and [CVE-2022-21655](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21655). Both CVEs were patched in Envoy versions 1.18.6, 1.19.3, and 1.20.2.
Envoy 1.16.x and older releases are no longer supported (see [HCSEC-2022-07](https://discuss.hashicorp.com/t/hcsec-2022-07-consul-s-connect-service-mesh-affected-by-recent-envoy-security-releases/36332)). Consul 1.9.x clusters should be upgraded to 1.10.x and Envoy upgraded to the latest supported Envoy version for that release, 1.18.6. Envoy 1.16.x and older releases are no longer supported (see [HCSEC-2022-07](https://discuss.hashicorp.com/t/hcsec-2022-07-consul-s-connect-service-mesh-affected-by-recent-envoy-security-releases/36332)). Consul 1.9.x clusters should be upgraded to 1.10.x and Envoy upgraded to the latest supported Envoy version for that release, 1.18.6.