Contour
v1.33.8Networking & MessagingA security-focused maintenance release fixes three disclosed Contour vulnerabilities and updates dependencies for CVE fixes. It also includes Envoy and Go updates plus Kubernetes compatibility testing for versions 1.35 through 1.37.
Action needed (1)
securityDependency updates for CVE fixes
Dependencies were updated to fix CVEs.
Check if affected (3)
securityGHSA-899w-6852-7fr3 crash loop for
Ingressresource backendsApplies if an
Ingresshas a resource backend.Fixes the crash loop described by GHSA-899w-6852-7fr3 when an
Ingresshas a resource backend.securityGHSA-9x3c-68m7-f3x4 protection for
HTTPProxyJWKS settingsApplies if one
HTTPProxyuses the same JWKS host as anotherHTTPProxy.Fixes GHSA-9x3c-68m7-f3x4, which allowed one
HTTPProxyto replace the JWKS settings of anotherHTTPProxyusing the same JWKS host.securityGHSA-g6qh-g3pq-5cpm request matching for included
HTTPProxyresourcesApplies if an
HTTPProxyis included and uses regex matching outside its prefix.Fixes GHSA-g6qh-g3pq-5cpm, which allowed an included
HTTPProxyto receive requests outside its prefix when regex was used.
All 3 other recorded changesvalue changes 2 · constraints 1
value changes (2)
- - Updates Envoy to v1.38.9. See the [Envoy release notes](https://www.envoyproxy.io/docs/envoy/v1.38.9/version_history/v1.38/v1.38.9) for more information about the content of the release.
- - Bumps Go to 1.26.10.
constraints (1)
- Contour v1.33.8 is tested against Kubernetes 1.35 through 1.37.
A weekly email arrives when a release needs action. Like the security patches in this release.