🛡️ openSUSE-SU-2025:0003-1 — etcd (CVE-2023-48795 +4 more)

Security update for etcd

This update for etcd fixes the following issues:

Update to version 3.5.12:

• Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795
• test: fix TestHashKVWhenCompacting: ensure all goroutine finished
• print error log when creating peer listener failed
• mvcc: Printing etcd backend database related metrics inside scheduleCompaction function
• dependency: update go version to 1.20.13
• commit bbolt transaction if there is any pending deleting operations
• add tests to test tx delete consistency.
• Don't flock snapshot files
• Backport adding digest for etcd base image.
• Add a unit tests and missing flags in etcd help.
• Add missing flag in etcd help.
• Backport testutils.ExecuteUntil to 3.5 branch
• member replace e2e test
• Check if be is nil to avoid panic when be is overriden with nil by recoverSnapshotBackend on line 517
• Don't redeclare err and snapshot variable, fixing validation of consistent index and closing database on defer
• test: enable gofail in release e2e test.
• [3.5] backport health check e2e tests.
• tests: Extract e2e cluster setup to separate package
• Update to version 3.5.11:
• etcdserver: add linearizable_read check to readyz.
• etcd: Update go version to 1.20.12
• server: disable redirects in peer communication
• etcdserver: add metric counters for livez/readyz health checks.
• etcdserver: add livez and ready http endpoints for etcd.
• http health check bug fixes
• server: Split metrics and health code
• server: Cover V3 health with tests
• server: Refactor health checks
• server: Run health check tests in subtests
• server: Rename test case expect fields
• server: Use named struct initialization in healthcheck test
• Backport server: Don't follow redirects when checking peer urls.
• Backport embed: Add tracing integration test.
• Backport server: Have tracingExporter own resources it initialises.
• Backport server: Add sampling rate to distributed tracing.
• upgrade github.com/stretchr/testify,google.golang.org/genproto/googleapis/api,google.golang.org/grpc to make it consistent
• CVE-2023-47108: Backport go.opentelemetry.io/[email protected] and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected]
• github workflow: run arm64 tests on every push
• etcd: upgrade go version from 1.20.10 to 1.20.11
• bump bbolt to 1.3.8 for etcd 3.5
• 3.5: upgrade gRPC-go to 1.58.3
• Backport corrupt check test fix 'etcd server shouldn't wait for the ready notification infinitely on startup'
• etcdserver: add cluster id check for hashKVHandler
• [release-3.5]: upgrade gRPC-go to v1.52.0
• backport #14125 to release-3.5: Update to grpc-1.47 (and fix the connection-string format)
• Return to default write scheduler since golang.org/x/[email protected] started using round robin
• Bump go to v1.20.10 Part of https://github.com/etcd-io/etcd/issues/16740
• bump golang.org/x/net to 0.17.0 Part of https://github.com/etcd-io/etcd/issues/16740
• etcd: upgrade go version to 1.20.9
• Remove obsolete http 1.0 version.
• fix:Ensure that go version is only defined in one file for release-3.5
• Fix panic in etcd validate secure endpoints
• dependency: bump golang to 1.20.8
• Backport redirect metrics data into file to reduce output.
• test.sh: increase timeout for grpcproxy test
• test: add v3 curl test to cover maintenance hash/hashkv REST API
• api: fix duplicate gateway url issue
• pkg: add a verification on the pagebytes which must be > 0
• tests: Backport deflake for TestWatchDelay
• tests: Backport deflake for TestPageWriterRandom
• Backport adding unit test for socket options.
• Backport export reuse-port and reuse-address
• Fix goword failure in rafthttp/transport.go.
• Backport update to golang 1.20 minor release.
• bump go version to 1.19.12
• Update workflows to use makefile recipes for unit, integration & e2e-release.
• Backport Makefile recipes for common test commands.
• pkg/flags: fix UniqueURLs'Set to remove duplicates in UniqueURLs'uss
• Backport fix to e2e release version identifcation.
• Backport #14368 to v3.5
• Follow up https://github.com/etcd-io/etcd/pull/16068#discussion_r1263667496
• etcdserver: backport check scheduledCompactKeyName and finishedCompactKeyName before writing hash to release-3.5.
• Backport #13577 Disable auth gracefully without impacting existing watchers.
• bump go version to 1.19.11 to fix CVE GO-2023-1878
• clientv3: create keepAliveCtxCloser goroutine only if ctx can be canceled
• [3.5] etcdutl: fix db double closed
• clientv3: remove v3.WithFirstKey() in Barrier.Wait()
• update etcdctl flag description for snapshot restores
• etcdutl: update description for --mark-compacted and --bump-revision flags in snapshot restore command
• Adding optional revision bump and mark compacted to snapshot restore
• Revert 'Merge pull request #16119 from natusameer/release-3