# OES Release Notes for Spinnaker Version v1.33.3

### OSS Spinnaker reference 

The images are forked out of OSS Spinnaker 1.33.3

The halyard version is forked out of [Halyard Commits](https://github.com/spinnaker/halyard/commits/v1.65.0) except for the following two auto bump commits 

[https://github.com/spinnaker/halyard/commit/397efbf2f71d3deca8db3667ef3f287c392c 9097 ](https://github.com/spinnaker/halyard/commit/397efbf2f71d3deca8db3667ef3f287c392c9097)[https://github.com/spinnaker/halyard/commit/c01d64838569d6a8c651130d0bc1e65de7 13cc93](https://github.com/spinnaker/halyard/commit/c01d64838569d6a8c651130d0bc1e65de713cc93) 

## Release Notes

The following are the releases made in OES after v1.33.3

## OES 1.33.3.20250301 (27 May 2025)

### Enhancements

* Library updates have been made to address critical security vulnerabilities as provided in the table below:

<table data-header-hidden><thead><tr><th width="67.19998168945312"></th><th></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Sl No</strong></td><td><strong>CVE</strong></td><td><strong>Package</strong></td><td><strong>Upgrade Version From</strong></td><td><strong>Upgrade Version To</strong></td><td><strong>Service Name</strong></td></tr><tr><td>1</td><td>CVE-2024-38821</td><td>org.projectlombok:lombok</td><td>  -</td><td>1.18.38</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>2</td><td>CVE-2024-38821</td><td><p>org.springframework.boot:spring-boot-configuration-processor</p><p><br></p></td><td>7.9</td><td><p>3.3.11</p><p><br></p></td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>3</td><td>CVE-2024-38821</td><td><p>org.jetbrains.kotlin:kotlin-stdlib</p><p><br></p></td><td>2.8.0</td><td><p>1.9.21</p><p><br></p></td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>4</td><td>CVE-2024-38821</td><td><p>org.apache.logging.log4j:log4j-bom</p><p><br></p></td><td>2.20.0</td><td><p>2.23.1</p><p><br></p></td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>5</td><td>CVE-2024-38821</td><td>com.thoughtworks.xstream:xstream</td><td>1.4.20</td><td>1.4.21</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>6</td><td>CVE-2024-38821</td><td>org.codehaus.jettison:jettison</td><td>1.5.2</td><td>1.5.4</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>7</td><td>CVE-2024-38821</td><td>org.jsoup:jsoup</td><td>1.14.2</td><td>1.15.3</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>8</td><td>CVE-2024-38821</td><td>org.apache.httpcomponents.client5:httpclient5</td><td>5.1.4</td><td>5.4.2</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>9</td><td>CVE-2024-38821</td><td>io.grpc:grpc-protobuf</td><td>1.45.1</td><td>1.53.0</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>10</td><td>CVE-2024-38821</td><td><p>org.jooq:jooq-kotlin</p><p><br></p></td><td>3.17.14</td><td>3.19.22</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>11</td><td>CVE-2024-38821</td><td><p>com.squareup.okhttp3:logging-interceptor</p><p>com.squareup.okhttp3:mockwebserver</p><p>com.squareup.okhttp3:okhttp-sse</p><p>com.squareup.okhttp3:okhttp-urlconnection</p><p>com.squareup.okhttp3:okhttp</p><p><br></p><p><br></p></td><td>4.9.3</td><td>4.12.0</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>12</td><td>CV-2024-38821</td><td><p>org.springframework.boot:spring-boot-dependencies</p><p><br></p></td><td>3.0.9</td><td>3.3.11</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>13</td><td>CV-2024-38821</td><td><p>org.springframework.boot : spring-boot</p><p>org.springframework.boot : spring-boot-actuator</p><p>org.springframework.boot : spring-boot-actuator-autoconfigure</p><p>org.springframework.boot : spring-boot-autoconfigure</p><p>org.springframework.boot : spring-boot-starter</p><p>org.springframework.boot : spring-boot-starter-actuator</p><p>org.springframework.boot : spring-boot-starter-aop</p><p>org.springframework.boot : spring-boot-starter-json</p><p>org.springframework.boot : spring-boot-starter-logging</p><p>org.springframework.boot : spring-boot-starter-reactor-netty</p><p>org.springframework.boot : spring-boot-starter-security</p><p>org.springframework.boot : spring-boot-starter-test</p><p>org.springframework.boot : spring-boot-starter-tomcat</p><p>org.springframework.boot : spring-boot-starter-validation</p><p>org.springframework.boot : spring-boot-starter-web</p><p>org.springframework.boot : spring-boot-starter-webflux</p><p>org.springframework.boot : spring-boot-test</p><p>org.springframework.boot : spring-boot-test-autoconfigure</p><p>org.springframework.boot : spring-boot-configuration-processor</p><p><br></p><p><br></p></td><td>3.0.9</td><td>3.3.11</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>14</td><td>CVE-2024-38821</td><td><p>org.springframework.cloud:spring-cloud-dependencies</p><p><br></p></td><td>2022.0.2</td><td>2023.0.5</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>15</td><td>CVE-2024-38821</td><td><p>org.springframework.cloud:spring-cloud-commons </p><p>org.springframework.cloud:spring-cloud-config-client</p><p>org.springframework.cloud:spring-cloud-config-server</p><p>org.springframework.cloud:spring-cloud-context</p><p><br></p></td><td>4.0.2</td><td>4.1.5</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>16</td><td><p>CVE-2023-34042</p><p>CVE-2024-22257</p><p>CVE-2024-38827</p><p>CVE-2024-38821</p><p><br></p></td><td><p>org.springframework.security:spring-security-config</p><p>org.springframework.security:spring-security-core</p><p>org.springframework.security:spring-security-crypto</p><p>org.springframework.security:spring-security-web</p></td><td>6.0.5</td><td>6.3.9</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>17</td><td>CVE-2024-38821</td><td>org.springframework:spring-webmvc</td><td>6.0.14</td><td>6.1.14</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>18</td><td><p>CVE-2024-38820</p><p>CVE-2024-22243</p><p>CVE-2024-22259</p><p>CVE-2024-22262</p><p>CVE-2024-38809</p><p>CVE-2024-38816</p><p>CVE-2024-38819</p><p>CVE-2024-38816</p><p>CVE-2024-38819</p><p> </p><p><br></p></td><td><p>org.springframework:spring-aop</p><p>org.springframework:spring-context</p><p>org.springframework:spring-core</p><p>org.springframework:spring-expression</p><p>org.springframework:spring-jcl</p><p>org.springframework:spring-jdbc</p><p>org.springframework:spring-test</p><p>org.springframework:spring-tx</p><p>org.springframework:spring-web</p><p>org.springframework:spring-webflux</p><p>org.springframework:spring-webmvc</p><p><br><br></p></td><td>6.0.14</td><td>6.1.19</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>19</td><td>CVE-2024-38821</td><td>ch.qos.logback:logback-access</td><td>1.4.12</td><td>1.5.18</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>20</td><td>CVE-2024-38821</td><td>ch.qos.logback:logback-classic</td><td>1.4.12</td><td>1.5.18</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>21</td><td>CVE-2024-38821</td><td>ch.qos.logback:logback-core</td><td>1.4.12</td><td>1.5.18</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>22</td><td><p>CVE-2024-34750</p><p>CVE-2024-50379</p><p>CVE-2024-56337</p><p>CVE-2024-24549</p><p>CVE-2024-23672</p><p><br></p></td><td><p>org.apache.tomcat.embed:tomcat-embed-core</p><p>org.apache.tomcat.embed:tomcat-embed-el</p><p>org.apache.tomcat.embed:tomcat-embed-websocket</p><p><br></p></td><td>10.1.16</td><td>10.1.40</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>23</td><td>CVE-2024-38821</td><td>com.mysql:mysql-connector-j</td><td>8.0.33</td><td>8.2.0</td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>24</td><td>CVE-2024-3882CVE-2024-388211</td><td><p>io.micrometer:micrometer-registry-prometheus</p><p><br></p></td><td>  -</td><td><p>1.13.13</p><p><br></p></td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>25</td><td>CVE-2024-38821</td><td><p>org.springframework:spring-webmvc</p><p><br></p></td><td>6.0.14</td><td><p><br></p><p>6.1.14</p><p><br></p></td><td>Gate,kayenta,orca,rosco,front50,fiat,clouddriver,igor,echo, halyard</td></tr><tr><td>26</td><td>CVE-2023-24538,CVE-2023-24540,CVE-2024-24790</td><td>HELM_VERSION</td><td>3.14.4</td><td>3.18.0</td><td>rosco</td></tr><tr><td>27</td><td>CVE-2023-24538,CVE-2023-24540,CVE-2024-24790</td><td>PACKER_VERSION</td><td>1.11.0</td><td>1.12.0</td><td>rosco</td></tr></tbody></table>

## OES 1.33.3.20241100 (25 Nov 2024)

### Enhancements

* Library updates have been made to address critical security vulnerabilities as provided in the table below:

<table data-header-hidden><thead><tr><th width="71"></th><th></th><th width="123"></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Sl. No</strong></td><td><strong>CVE</strong></td><td><strong>Package</strong></td><td><strong>Upgraded from Version</strong></td><td><strong>Upgraded to Version</strong></td><td><strong>Services</strong></td></tr><tr><td>1</td><td><p>CVE-2024-24790</p><p>CVE-2022-23806</p><p>CVE-2023-24538</p><p>CVE-2023-24540</p></td><td>KUBECTL_RELEASE</td><td>1.22.0</td><td>1.31.0</td><td>clouddriver, rosco,halyrad</td></tr><tr><td>2</td><td>CVE-2024-24790</td><td>AWS_CLI_S3_CMD</td><td>2.0.2</td><td>2.4.0</td><td>clouddriver</td></tr><tr><td>3</td><td>CVE-2024-24790</td><td>AWS_AIM_AUTHENTICATOR</td><td>0.6.14</td><td>0.6.27</td><td>clouddriver</td></tr><tr><td>4</td><td>CVE-2024-24790</td><td>GOOGLE_CLOUD_SDK</td><td>468.0.0</td><td>496.0.0</td><td>clouddriver</td></tr><tr><td>5</td><td>CVE-2024-22790</td><td>PACKER_VERSION</td><td>1.10.1</td><td>1.11.2</td><td>rosco</td></tr><tr><td>6</td><td>CVE-2024-22790</td><td>KUSTOMIZE_VERSION</td><td>5.0.3</td><td>5.4.3</td><td>rosco</td></tr><tr><td>7</td><td><p>CVE-2024-45490</p><p>CVE-2024-45491</p><p>CVE-2024-45492</p></td><td>expat</td><td>2.2.5-11.el8</td><td>2.2.5-15.el8_10</td><td>clouddriver, fiat, front50, kayenta, orca, igor, gate, echo, rosco</td></tr><tr><td>8</td><td>CVE-2024-37371</td><td>krb5-libs</td><td>1.18.2-28.el8_10</td><td>1.18.2-29.el8_10</td><td>clouddriver, fiat, front50, kayenta, orca, igor, gate, echo, Rosco</td></tr></tbody></table>

## OES 1.33.3.20240600 (9 Aug 2024)

### Enhancements

* The Spinnaker version is upgraded from v1.30.1 to v1.33.3. For more information on Spinnaker versions, see [Versions](https://spinnaker.io/docs/releases/versions/).&#x20;