<!-- 
RSS generated by JIRA (1001.0.0-SNAPSHOT#100246-sha1:7a5c50119eb0633d306e14180817ddef5e80c75d) at Thu Feb 08 23:26:05 UTC 2024

It is possible to restrict the fields that are returned in this document by specifying the 'field' parameter in your request.
For example, to request only the issue key and summary add field=key&field=summary to the URL of your request.
-->
<rss version="0.92" >
<channel>
    <title>FOLIO Jira</title>
    <link>https://folio-org.atlassian.net</link>
    <description>This file is an XML representation of an issue</description>
    <language>en-us</language>    <build-info>
        <version>1001.0.0-SNAPSHOT</version>
        <build-number>100246</build-number>
        <build-date>07-02-2024</build-date>
    </build-info>

<item>
            <title>[FOLIO-3163] Update jenkins-slave-docker/Dockerfile.focal-java-11: Ansible, Docker, Yarn, Node</title>
                <link>https://folio-org.atlassian.net/browse/FOLIO-3163</link>
                <project id="10290" key="FOLIO">FOLIO</project>
                    <description>&lt;ul&gt;
	&lt;li&gt;Update Ansible from 2.9.13 to 2.9.21 fixing security issues:
	&lt;ul&gt;
		&lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/cve-2021-2022&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://access.redhat.com/security/cve/cve-2021-2022&lt;/a&gt; - Mask default and fallback values for `no_log` module options&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/cve-2021-20191&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://access.redhat.com/security/cve/cve-2021-20191&lt;/a&gt; - Various modules missing `no_log` on sensitive module arguments&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/cve-2021-20180&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://access.redhat.com/security/cve/cve-2021-20180&lt;/a&gt; - `bitbucket_pipeline_variable` - hide user sensitive information which are marked as `secured` from logging into the console&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/cve-2021-20178&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://access.redhat.com/security/cve/cve-2021-20178&lt;/a&gt; - `snmp_facts` - hide user sensitive information such as ``privkey`` and ``authkey`` from logging into the console&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/cve-2020-1753&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://access.redhat.com/security/cve/cve-2020-1753&lt;/a&gt; - kubectl connection plugin - now redacts `kubectl_token` and `kubectl_password` in console log&lt;/li&gt;
	&lt;/ul&gt;
	&lt;/li&gt;
&lt;/ul&gt;


&lt;ul&gt;
	&lt;li&gt;Update Docker from 19.03.9 to 20.10.6 fixing
	&lt;ul&gt;
		&lt;li&gt;CVE-2021-21285 Prevent an invalid image from crashing docker daemon &lt;a href=&quot;https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8&lt;/a&gt;&lt;/li&gt;
		&lt;li&gt;CVE-2021-21284 Lock down file permissions to prevent remapped root from accessing docker state &lt;a href=&quot;https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc&lt;/a&gt;&lt;/li&gt;
		&lt;li&gt;CVE-2019-14271 loading of nsswitch based config inside chroot under Glibc &lt;a href=&quot;https://github.com/moby/moby/pull/39612&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/moby/moby/pull/39612&lt;/a&gt;&lt;/li&gt;
		&lt;li&gt;CVE-2020-15257 Update bundled static binaries of containerd to v1.3.9 &lt;a href=&quot;https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4&lt;/a&gt;&lt;/li&gt;
	&lt;/ul&gt;
	&lt;/li&gt;
&lt;/ul&gt;


&lt;ul&gt;
	&lt;li&gt;Update Yarn from 1.22.4 to 1.22.5, to the classic stable version: &lt;a href=&quot;https://classic.yarnpkg.com/lang/en/&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://classic.yarnpkg.com/lang/en/&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;


&lt;ul&gt;
	&lt;li&gt;The re-build also updates many other tools, most notably Node:&lt;/li&gt;
&lt;/ul&gt;


&lt;ul&gt;
	&lt;li&gt;Update Node from 12.20.1 to 12.22.1 fixing
	&lt;ul&gt;
		&lt;li&gt;&lt;a href=&quot;https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/&lt;/a&gt; OpenSSL - CA certificate check bypass with `X509_V_FLAG_X509_STRICT` (CVE-2021-3450)&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/&lt;/a&gt; OpenSSL - NULL pointer deref in signature_algorithms processing (CVE-2021-3449)&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/&lt;/a&gt; npm upgrade - Update y18n to fix Prototype-Pollution (CVE-2020-7774)&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/&lt;/a&gt; HTTP2 &apos;unknownProtocol&apos; cause Denial of Service by resource exhaustion (CVE-2021-22883)&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/&lt;/a&gt; DNS rebinding in --inspect (CVE-2021-22884)&lt;/li&gt;
		&lt;li&gt;&lt;a href=&quot;https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/&lt;/a&gt; OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)&lt;/li&gt;
	&lt;/ul&gt;
	&lt;/li&gt;
&lt;/ul&gt;
</description>
                <environment></environment>
        <key id="82049">FOLIO-3163</key>
            <summary>Update jenkins-slave-docker/Dockerfile.focal-java-11: Ansible, Docker, Yarn, Node</summary>
                <type id="10001" iconUrl="https://folio-org.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10303?size=medium">Bug</type>
                                            <priority id="10001" iconUrl="https://dev.folio.org/assets/jira-priority/jira-p2.svg">P2</priority>
                        <status id="6" iconUrl="https://folio-org.atlassian.net/images/icons/statuses/closed.png" description="The issue is considered finished, the resolution is correct. Issues which are closed can be reopened.">Closed</status>
                    <statusCategory id="3" key="done" colorName="green"/>
                                    <resolution id="10003">Done</resolution>
                                                        <assignee accountid="61cd0ca0bce5e00069e98be7">David Crossley</assignee>
                                                                <reporter accountid="5ee89462f7aa140abd82d11d">Julian Ladisch</reporter>
                                    <labels>
                            <label>security</label>
                            <label>security-reviewed</label>
                    </labels>
                <created>Mon, 17 May 2021 12:17:11 +0000</created>
                <updated>Tue, 13 Jul 2021 08:46:55 +0000</updated>
                            <resolved>Fri, 21 May 2021 23:29:45 +0000</resolved>
                                                                        <due></due>
                            <votes>0</votes>
                                    <watches>2</watches>
                                                                <comments>
                                                            <comment id="197564" author="5ee89462f7aa140abd82d11d" created="Wed, 19 May 2021 14:06:10 +0000"  >&lt;p&gt;Pull request for code review: &lt;a href=&quot;https://github.com/folio-org/folio-tools/pull/180&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/folio-org/folio-tools/pull/180&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;After this is merged I will create similar Jiras for Dockerfile.agent-focal-java-11 and Dockerfile.xenial-java-8.&lt;/p&gt;</comment>
                                                            <comment id="197565" author="61cd0ca0bce5e00069e98be7" created="Fri, 21 May 2021 03:01:56 +0000"  >&lt;p&gt;I commenced work today on building and verifiying this Dockerfile.focal-java-11&lt;/p&gt;

&lt;p&gt;Regarding those other Dockerfiles: See the notes at 
    &lt;span class=&quot;jira-issue-macro resolved&quot; data-jira-key=&quot;FOLIO-3167&quot; &gt;
                &lt;a href=&quot;https://folio-org.atlassian.net/browse/FOLIO-3167&quot; class=&quot;jira-issue-macro-key issue-link&quot;  title=&quot;Update folio-tools to use Postgres 12&quot; &gt;
            &lt;img class=&quot;icon&quot; src=&quot;https://folio-org.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10322?size=medium&quot; /&gt;
            FOLIO-3167
        &lt;/a&gt;
                                                    &lt;span class=&quot;aui-lozenge aui-lozenge-subtle aui-lozenge-success jira-macro-single-issue-export-pdf&quot;&gt;Closed&lt;/span&gt;
            &lt;/span&gt;
. The Dockerfile.xenial-java-8 is deprecated. The Dockerfile.agent-focal-java-11 is an experiment.&lt;/p&gt;</comment>
                                                            <comment id="197566" author="61cd0ca0bce5e00069e98be7" created="Fri, 21 May 2021 23:29:21 +0000"  >&lt;p&gt;Tested with mod-notes and ui-checking and &lt;a href=&quot;https://jenkins-aws.indexdata.com/job/FOLIO_Reference_Builds/job/folio-snapshot-test/382/consoleFull&quot; class=&quot;external-link&quot; rel=&quot;nofollow noreferrer&quot;&gt;folio-snapshot-test #383&lt;/a&gt;&lt;/p&gt;</comment>
                    </comments>
                    <attachments>
                    </attachments>
                <subtasks>
                    </subtasks>
                <customfields>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                <customfield id="customfield_10000" key="com.atlassian.jira.plugins.jira-development-integration-plugin:devsummarycf">
                        <customfieldname>Development</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10057" key="com.atlassian.jira.plugin.system.customfieldtypes:select">
                        <customfieldname>Development Team</customfieldname>
                        <customfieldvalues>
                                <customfieldvalue key="10155"><![CDATA[FOLIO DevOps]]></customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                <customfield id="customfield_10063" key="com.atlassian.jira.plugin.system.customfieldtypes:float">
                        <customfieldname>PO Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>0.0</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                            <customfield id="customfield_10019" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>0|i02q3z:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    <customfield id="customfield_10020" key="com.pyxis.greenhopper.jira:gh-sprint">
                        <customfieldname>Sprint</customfieldname>
                        <customfieldvalues>
                                <customfieldvalue id="1992">DevOps Sprint 114</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        <customfield id="customfield_10024" key="com.atlassian.jira.ext.charting:firstresponsedate">
                        <customfieldname>[CHART] Date of First Response</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>Fri, 21 May 2021 03:01:56 +0000</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10025" key="com.atlassian.jira.ext.charting:timeinstatus">
                        <customfieldname>[CHART] Time in Status</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                    </customfields>
    </item>
</channel>
</rss>