Description
/kind task
/area registry
This is a follow-up issue to #1315.
As commented out in #1315 (comment)_, it is strongly recommended, as one of the possible mitigation measures, to disable HTTP/2 endpoints if not needed: https://access.redhat.com/security/cve/CVE-2023-44487
And from this analysis, there seems to be currently only one repo where we need to do so:
- devfile/registry-support: in the
index/server
folder, where an HTTP Server is started
The steps for disabling the HTTP/2 protocol in net/http
are documented in https://pkg.go.dev/net/http#hdr-HTTP_2
Acceptance Criteria
- Disable HTTP/2 protocol in servers started in the
devfile/registry-support
repo - Make sure it doesn't break the way existing clients interact with registries
Metadata
Metadata
Assignees
Type
Projects
Status
Done ✅