chore(deps): update dependency replicatedhq/kots to v1.107.0

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
replicatedhq/kots	minor	1.106.0 -> 1.107.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

replicatedhq/kots (replicatedhq/kots)

v1.107.0

Compare Source

Changelog

• 2b655b4 Update KOTS image dependency tags (#​4411)
• 4b5248b Fix building kotsadm bundle (#​4410)
• 1980b7f Arm64 support for KOTS images (#​4394)
• 98e957b Update KOTS image dependency tags (#​4408)
• 7450be0 Bump tough-cookie from 4.0.0 to 4.1.3 in /web (#​4407)
• d0e6b4d Bump slackapi/slack-github-action from 1.24.0 to 1.25.0 (#​4405)
• 5607ba5 Update KOTS image dependency tags (#​4406)
• 59e3eeb Bump the security group with 1 update (#​4403)
• 8de0dc9 Bump peter-evans/repository-dispatch from 2 to 3 (#​4404)
• ce358e8 simplify snapshot disable code (#​4399)
• ef18b36 update embedded cluster check in apps handler (#​4401)
• 6d22994 embedded cluster upgrade modal (#​4398)
• 40b64d5 Update KOTS image dependency tags (#​4400)
• bf57f45 disable snapshots and gitops on embedded cluster (#​4397)
• 90a6319 fix AddonsInstalling constant (#​4396)
• 361a47b Bump the security group with 1 update (#​4393)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/kots:1.107.0

📦 Image Reference ghcr.io/uniget-org/tools/kots:1.107.0

digest	sha256:804befacd92c3ee15d90f2e8ac88f562ee890853e721366d1af0fed2d292a394
vulnerabilities
platform	linux/amd64
size	31 MB
packages	385

github.com/dexidp/dex 0.0.0-20230630132844-08bb7fb98b16 (golang) pkg:golang/github.com/dexidp/dex@0.0.0-20230630132844-08bb7fb98b16 Inadequate Encryption Strength Affected range >=0.0.0-20230630132844-08bb7fb98b16 <0.0.0-20240125142631-9451d87ca0c9 Fixed version 0.0.0-20240125142631-9451d87ca0c9 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on dexidp/dex#2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating. https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425 is seemingly setting TLS 1.2 as minimum version, but the whole tlsConfig is ignored after "TLS cert reloader" was introduced in dexidp/dex#2964. Configured cipher suites are not respected either, as seen on the output. PoC Build Dex, generate certs with gencert.sh, modify config.dev.yaml to run on https, using generated certs. issuer: http://127.0.0.1:5556/dex storage: type: sqlite3 config: file: dex.db web: https: 127.0.0.1:5556 tlsCert: examples/k8s/ssl/cert.pem tlsKey: examples/k8s/ssl/key.pem <rest as default> Run dex bin/dex serve config.dev.yaml. Install sslyze, easy to use SSL connection analyzer: pip3 install sslyze sslyze 127.0.0.1:5556 In Dex 2.37.0, TLS 1.0 and TLS 1.1 are enabled in addition to expected TLS 1.2 and TLS 1.3. * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 6 cipher suites: TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 6 cipher suites: TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 11 cipher suites: TLS_RSA_WITH_AES_256_GCM_SHA384 256 TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_GCM_SHA256 128 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) TLS_AES_128_GCM_SHA256 128 ECDH: X25519 (253 bits) In Dex 2.36.0, TLS 1.0 and TLS 1.1 are disabled as expected. * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 5 cipher suites: TLS_RSA_WITH_AES_256_GCM_SHA384 256 TLS_RSA_WITH_AES_128_GCM_SHA256 128 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) Impact TLS 1.0 and TLS 1.1 connections can be decrypted by the attacker, and hence decrypt the traffic to Dex.

github.com/aws/aws-sdk-go 1.50.5 (golang) pkg:golang/github.com/aws/aws-sdk-go@1.50.5 Affected range >=0 Fixed version Not Fixed Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client. Affected range >=0 Fixed version Not Fixed Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client.

k8s.io/apiserver 0.29.1 (golang) pkg:golang/k8s.io/apiserver@0.29.1 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.15.10 Fixed version 1.15.10, 1.16.7, 1.17.3 CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Description The Kubernetes API server component has been found to be vulnerable to a denial of service attack via successful API requests.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/7719839750.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/7719839750.