Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package istioctl for openSUSE:Factory checked in at 2026-10-16 20:09:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/istioctl (Old) and /work/SRC/openSUSE:Factory/.istioctl.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "istioctl" Fri Oct 16 20:09:17 2026 rev:57 rq:1385098 version:1.31.2 Changes: -------- --- /work/SRC/openSUSE:Factory/istioctl/istioctl.changes 2026-09-22 15:52:24.157204432 +0200 +++ /work/SRC/openSUSE:Factory/.istioctl.new.3698736/istioctl.changes 2026-10-16 20:12:44.674874216 +0200 @@ -1,0 +2,41 @@ +Fri Oct 16 04:51:58 UTC 2026 - Johannes Kastl <[email protected]> + +- update to 1.31.2: + * Envoy CVEs + - GHSA-8vc2-jrm4-835w: (CVSS score 7.5): Fixed an + unauthenticated remote crash in the OAuth2 HTTP filter on a + CONNECT request without a :path header. + - GHSA-47vj-9r25-wv5j: (CVSS score 6.5): Fixed a crash in the + api_key_auth HTTP filter on a CONNECT request without a :path + header. + * Istio CVEs + - GHSA-w44g-8m76-8gc5 (CVSS score 7.4, High): + AuthorizationPolicy method rules are bypassed over HTTP/2 by + changing the case of the method. Credit: This vulnerability + was discovered and reported by izzy0101010101. + - GHSA-7p2q-4xvg-vxc6 (CVSS score 7.7, High): istiod crashes in + ambient mode when a ServiceEntry or other service claims the + address of an IP-addressed waypoint. Credit: This + vulnerability was discovered and reported by yshch. + * Other Istio Security Fixes + - Fixed istioctl skipping verification of the istiod + certificate when connecting to XDS with a service account + token (istioctl proxy-status, istioctl x internal-debug, and + --xds-address in general). istioctl now verifies the server + against the Istio root certificate from the + istio-ca-root-cert configmap and the expected server name: + --authority if set, the host of --xds-address if it is a DNS + name, or istiod.<istio-namespace>.svc when connecting to an + IP address or localhost. Pass --insecure (or set + ISTIOCTL_INSECURE=true) to explicitly skip verification. + Credit: This issue was reported by Leon Zlobecki. (Issue + #41937) + - Fixed istioctl manifest translate writing unquoted values + from IstioOperator input (such as namespace and release name) + into generated install shell scripts. Crafted values could + inject additional shell commands when those scripts were run. + Arguments are now escaped with shellescape.Quote. Credit: + This vulnerability was discovered and reported by OpenSec + Intelligence. + +------------------------------------------------------------------- Old: ---- istioctl-1.31.1.obscpio New: ---- istioctl-1.31.2.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ istioctl.spec ++++++ --- /var/tmp/diff_new_pack.WSdU4e/_old 2026-10-16 20:12:52.347196951 +0200 +++ /var/tmp/diff_new_pack.WSdU4e/_new 2026-10-16 20:12:52.348196993 +0200 @@ -17,7 +17,7 @@ Name: istioctl -Version: 1.31.1 +Version: 1.31.2 Release: 0 Summary: CLI for the istio servic mesh in Kubernetes License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.WSdU4e/_old 2026-10-16 20:12:52.465201915 +0200 +++ /var/tmp/diff_new_pack.WSdU4e/_new 2026-10-16 20:12:52.472202209 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/istio/istio.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/1.31.1</param> + <param name="revision">refs/tags/1.31.2</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">disable</param> <param name="filename">istioctl</param> ++++++ istioctl-1.31.1.obscpio -> istioctl-1.31.2.obscpio ++++++ ++++ 12941 lines of diff (skipped) ++++++ istioctl.obsinfo ++++++ --- /var/tmp/diff_new_pack.WSdU4e/_old 2026-10-16 20:12:56.126355921 +0200 +++ /var/tmp/diff_new_pack.WSdU4e/_new 2026-10-16 20:12:56.130356089 +0200 @@ -1,5 +1,5 @@ name: istioctl -version: 1.31.1 -mtime: 1789588467 -commit: 190ae921b848ec010b8be4457533837ed8fce258 +version: 1.31.2 +mtime: 1792070362 +commit: e2f3a7949a358af7dd901a6f9ccd6ecdd7270271 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/istioctl/vendor.tar.gz /work/SRC/openSUSE:Factory/.istioctl.new.3698736/vendor.tar.gz differ: char 19, line 1
