Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package istioctl for openSUSE:Factory checked in at 2026-11-07 23:34:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/istioctl (Old) and /work/SRC/openSUSE:Factory/.istioctl.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "istioctl" Sat Nov 7 23:34:19 2026 rev:59 rq:1396064 version:1.31.4 Changes: -------- --- /work/SRC/openSUSE:Factory/istioctl/istioctl.changes 2026-10-24 22:06:49.311130267 +0200 +++ /work/SRC/openSUSE:Factory/.istioctl.new.3759290/istioctl.changes 2026-11-07 23:35:53.157663448 +0100 @@ -1,0 +2,66 @@ +Sat Nov 7 16:39:32 UTC 2026 - Johannes Kastl <[email protected]> + +- update to 1.31.4: + https://istio.io/latest/news/security/istio-security-2026-009/ + * Istio CVEs + - GHSA-rr2c-p22p-6r9r (CVSS score 8.2, High): In ambient mode, + an operator-precedence error let a port-level STRICT + PeerAuthentication be skipped when the workload mode was + PERMISSIVE or DISABLE under a mesh-wide STRICT policy, + allowing plaintext traffic to reach a port that required + mTLS. Credit: This vulnerability was discovered and reported + by Ravikanth Reddy. + - GHSA-7m6f-j3gp-2r53 (CVSS score 6.5, Moderate): An + AuthorizationPolicy when condition on + request.headers[:authority] or request.headers[host] was + matched case-sensitively, so a request with a + differently-cased host could bypass it. These conditions are + now matched case-insensitively, the same as hosts. Credit: + This vulnerability was discovered and reported by @akoul. + - GHSA-cxwg-46mx-q8hf (CVSS score 7.4, High): A new inbound + connection reusing the 4-tuple of a torn-down connection + could bypass the sidecar proxy by matching a stale conntrack + ESTABLISHED entry. A SYN-only rule is now evaluated ahead of + the ESTABLISHED divert rule in both iptables and nftables + modes. Credit: This vulnerability was discovered and reported + by @ramaraochavali, @akshayreddyb, @Pawan-Bishnoi, and + @deveshkandpal1224. + - GHSA-635j-qv98-9275 (CVSS score 7.7, High): Any workload with + a mesh identity could crash istiod by sending an + istio.io/debug xDS request whose resource name fails URL + parsing, leaving the control plane in a crash loop for the + whole mesh. The request is now rejected with InvalidArgument. + Credit: This vulnerability was discovered and reported by + Alon Lerner of Checkmarx Research. + - GHSA-8jw7-82jp-wr2c (CVSS score 6.3, Moderate): In ambient + mode, an AuthorizationPolicy with an empty to or from entry + that was not rejected by the validating webhook caused istiod + to crash and crash-loop until the policy was removed, + stopping config distribution for the whole mesh. Such entries + are now treated as an empty operation or source, matching the + sidecar behavior. Credit: This vulnerability was discovered + and reported by @r0binak. + - GHSA-gf6w-6mxv-5fj4 (CVSS score 6.3, Moderate): In + multicluster installations, a proxy could claim another + cluster’s CLUSTER_ID and receive that cluster’s kubernetes:// + secrets over SDS. istiod no longer accepts a node metadata + CLUSTER_ID that differs from the cluster the proxy’s token + was validated against. Credit: This vulnerability was + discovered and reported by Yonghwa Lee (Xint by Theori). + - GHSA-77vw-rg85-wx5x (CVSS score 6.5, Moderate): ztunnel + panicked when parsing a 55-byte traceparent header that did + not contain four dash-separated fields, terminating the + inbound HBONE connection task and dropping every stream + multiplexed on that connection. Headers with the correct + length but an invalid field layout were also accepted instead + of rejected. Invalid traceparent headers are now ignored and + a new trace ID is generated. Credit: This vulnerability was + discovered and reported by @RaphaelFakhri. + - GHSA-9gqj-583v-mpqp (CVSS score 5.6, Moderate): + AuthorizationPolicy ipBlocks, notIpBlocks and the source.ip + condition on ambient waypoints, and on sidecars receiving + HBONE traffic, matched the Envoy internal listener address + instead of the client IP, so DENY rules on these fields could + fail open. + +------------------------------------------------------------------- Old: ---- istioctl-1.31.3.obscpio New: ---- istioctl-1.31.4.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ istioctl.spec ++++++ --- /var/tmp/diff_new_pack.sNQZ4u/_old 2026-11-07 23:35:55.325753308 +0100 +++ /var/tmp/diff_new_pack.sNQZ4u/_new 2026-11-07 23:35:55.327753391 +0100 @@ -17,7 +17,7 @@ Name: istioctl -Version: 1.31.3 +Version: 1.31.4 Release: 0 Summary: CLI for the istio servic mesh in Kubernetes License: Apache-2.0 @@ -26,8 +26,8 @@ Source1: vendor.tar.gz BuildRequires: bash-completion BuildRequires: fdupes +BuildRequires: go1.26 >= 1.26.10 BuildRequires: zsh -BuildRequires: golang(API) >= 1.26 %description The istioctl tool is a configuration command line utility that allows service ++++++ _service ++++++ --- /var/tmp/diff_new_pack.sNQZ4u/_old 2026-11-07 23:35:55.380755588 +0100 +++ /var/tmp/diff_new_pack.sNQZ4u/_new 2026-11-07 23:35:55.384755753 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/istio/istio.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/1.31.3</param> + <param name="revision">refs/tags/1.31.4</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">disable</param> <param name="filename">istioctl</param> ++++++ istioctl-1.31.3.obscpio -> istioctl-1.31.4.obscpio ++++++ ++++ 8398 lines of diff (skipped) ++++++ istioctl.obsinfo ++++++ --- /var/tmp/diff_new_pack.sNQZ4u/_old 2026-11-07 23:35:57.161829407 +0100 +++ /var/tmp/diff_new_pack.sNQZ4u/_new 2026-11-07 23:35:57.164829531 +0100 @@ -1,5 +1,5 @@ name: istioctl -version: 1.31.3 -mtime: 1792626053 -commit: edd80bca5f71bd564711ef43ccd085acb545a6b4 +version: 1.31.4 +mtime: 1793907326 +commit: a079f649cbcb984cd8d9330699e165b89ff1f6a1 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/istioctl/vendor.tar.gz /work/SRC/openSUSE:Factory/.istioctl.new.3759290/vendor.tar.gz differ: char 24, line 1
