On Thu, Jun 10, 2021 at 09:03 James E. Blair wrote:
I just sent the following message to zuul-announce:
On 6/10/21 8:59 AM, James E. Blair wrote:
Multiple security issues have been identified in Zuul which could lead to an exposure of secret data. The Zuul Maintainers have been preparing fixes to these issues and plan to make a release of Zuul with them on Thursday, June 24, 2021, around 14:00 UTC.
Unfortunately, there is no known mitigation for these vulnerabilities, and so the best advice we can offer for operators is to stop Zuul shortly before the release, and restart it after updating.
Additionally, there will be some modification to the functionality offered by Zuul, which may cause some jobs to fail or behave differently. More details will be provided along with the release.
We encourage you to use the time between now and June 24th to ensure that you are running the latest version of Zuul (4.5.0) in order to prepare for the update.
An announcement of the release and accompanying information will be sent to zuul-announce@lists.zuul-ci.org when the release is available.
Feel free to follow up to zuul-discuss@lists.zuul-ci.org or chat with us in #zuul on OFTC if you have any questions.
Thank you Jim for the heads-up,
We have published these instructions for Software Factory users:
https://www.softwarefactory-project.io/upcoming-zuul-security-fix.html
Regards, -Tristan