Envoy
v1.40.1Networking & MessagingA security-focused patch removes trust in compromised certificate authorities and updates resolver dependencies. It also corrects Istio peer metadata behavior so peer app and version values again use the `app` and `version` labels, with Kubernetes labels as fallback.
Check if affected (3)
securityTrust in compromised eMudhra CAs removed from Envoy docker images
Applies if you use Envoy docker images.
The Envoy docker images no longer trust the compromised eMudhra CAs.
securityCertificate roots removed from the Envoy Mobile built-in bundle
Applies if you use Envoy Mobile with its built-in bundle.
The
AAA Certificate ServicesandemSign ECC Root CA - G3roots were removed from the root certificate bundle built into Envoy Mobile. Certificate chains that lead only to these roots are no longer trusted by Envoy Mobile.securityResolver dependency updates remove trust in compromised eMudhra intermediate CAs
Applies if you use the built-in Hickory DNS resolver.
The
webpki-rootsandrustls-webpkicrates used by the built-in Hickory DNS resolver were updated. DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised eMudhra intermediate CAs.
All 1 other recorded changesvalue changes 1
value changes (1)
- - contrib/istio: peer metadata conversion takes a peer's app name and version from the
appandversionlabels again, falling back toapp.andkubernetes. io/name app.only when those are absent or empty. This makes peer-reportedkubernetes. io/version source_app,destination_app,source_versionanddestination_versionmatch the values a workload reports for itself.
A weekly email arrives when a release needs action. Like the security patches in this release.