chore(deps): update dependency replicatedhq/kots to v1.107.5

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
replicatedhq/kots	patch	1.107.4 -> 1.107.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

replicatedhq/kots (replicatedhq/kots)

v1.107.5

Compare Source

Changelog

• 6e3b31d Include v1beta2 Helm charts images to known images in air gapped mode (#​4458)
• 86e0f97 Update KOTS image dependency tags (#​4456)
• 6351ff3 Bump the security group in /kurl_proxy with 3 updates (#​4454)
• 9f66bcd Update KOTS image dependency tags (#​4455)
• 10fe99a Bump the security group with 10 updates (#​4453)
• 8b47628 Bump tar-stream from 2.1.0 to 3.1.7 in /web (#​4452)
• 3b549c6 Bump the security group in /web with 25 updates (#​4451)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/kots:1.107.5

📦 Image Reference ghcr.io/uniget-org/tools/kots:1.107.5

digest	sha256:fc61ac7701c0dbe02b4d561411b2acd694560a4e56c25f0199746f88787e49cb
vulnerabilities
platform	linux/amd64
size	30 MB
packages	362

github.com/dexidp/dex 0.0.0-20230630132844-08bb7fb98b16 (golang) pkg:golang/github.com/dexidp/dex@0.0.0-20230630132844-08bb7fb98b16 Inadequate Encryption Strength Affected range >=0.0.0-20230630132844-08bb7fb98b16 <0.0.0-20240125142631-9451d87ca0c9 Fixed version 0.0.0-20240125142631-9451d87ca0c9 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on dexidp/dex#2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating. https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425 is seemingly setting TLS 1.2 as minimum version, but the whole tlsConfig is ignored after "TLS cert reloader" was introduced in dexidp/dex#2964. Configured cipher suites are not respected either, as seen on the output. PoC Build Dex, generate certs with gencert.sh, modify config.dev.yaml to run on https, using generated certs. issuer: http://127.0.0.1:5556/dex storage: type: sqlite3 config: file: dex.db web: https: 127.0.0.1:5556 tlsCert: examples/k8s/ssl/cert.pem tlsKey: examples/k8s/ssl/key.pem <rest as default> Run dex bin/dex serve config.dev.yaml. Install sslyze, easy to use SSL connection analyzer: pip3 install sslyze sslyze 127.0.0.1:5556 In Dex 2.37.0, TLS 1.0 and TLS 1.1 are enabled in addition to expected TLS 1.2 and TLS 1.3. * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 6 cipher suites: TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 6 cipher suites: TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 11 cipher suites: TLS_RSA_WITH_AES_256_GCM_SHA384 256 TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_GCM_SHA256 128 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) TLS_AES_128_GCM_SHA256 128 ECDH: X25519 (253 bits) In Dex 2.36.0, TLS 1.0 and TLS 1.1 are disabled as expected. * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 5 cipher suites: TLS_RSA_WITH_AES_256_GCM_SHA384 256 TLS_RSA_WITH_AES_128_GCM_SHA256 128 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) Impact TLS 1.0 and TLS 1.1 connections can be decrypted by the attacker, and hence decrypt the traffic to Dex.

github.com/aws/aws-sdk-go 1.50.20 (golang) pkg:golang/github.com/aws/aws-sdk-go@1.50.20 Affected range >=0 Fixed version Not Fixed Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client. Affected range >=0 Fixed version Not Fixed Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client.

k8s.io/apiserver 0.29.2 (golang) pkg:golang/k8s.io/apiserver@0.29.2 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.15.10 Fixed version 1.15.10, 1.16.7, 1.17.3 CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Description The Kubernetes API server component has been found to be vulnerable to a denial of service attack via successful API requests.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/7982554790.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/7982554790.