(DOCSP-9849): Operator 1.4.5 Release Notes (#239)

* (DOCSP-9849): Operator 1.4.5 Release Notes

* (DOCSP-9849): adding notes for 1.2.5

Author: jwilliams-mongo

source/release-notes.txt

@@ -20,6 +20,42 @@ Release Notes for |k8s-op-full|
       Production Notes </reference/production-notes>
       Known Issues </reference/known-issues>
 
+.. _ent-op-1.4.5:
+
+|k8s-op-full| 1.4.5
+-------------------
+
+Fixes CVE-2020-7922: |k8s| Operator generates potentially insecure certificates.
+
+CVE Description
+~~~~~~~~~~~~~~~
+
+X.509 certificates generated by the |k8s-op| may allow an attacker with 
+access to the |k8s| cluster improper access to MongoDB instances. 
+Customers who do not use X.509 authentication, and those who do not use 
+the |k8s-op-short| to generate their X.509 certificates are unaffected.
+
+Common Weakness Enumeration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+CWE-295: Improper Certificate Validation
+CVSS score: 6.4
+CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
+
+Affected Versions
+~~~~~~~~~~~~~~~~~
+
+- 1.0, 1.1
+- 1.2.0 - 1.2.4
+- 1.3.0 - 1.3.1
+- 1.4.0 - 1.4.4
+
+Fixed Versions
+~~~~~~~~~~~~~~
+
+- 1.2.5
+- 1.4.5 and above
+
 .. _ent-op-1.4.4:
 
 |k8s-op-full| 1.4.4
@@ -295,6 +331,42 @@ Bug Fixes
 
 - Sets ``USER`` in the |k8s-op-short| Docker image.
 
+.. _ent-op-1.2.5:
+
+|k8s-op-full| 1.2.5
+-------------------
+
+Fixes CVE-2020-7922: |k8s| Operator generates potentially insecure certificates.
+
+CVE Description
+~~~~~~~~~~~~~~~
+
+X.509 certificates generated by the |k8s-op| may allow an attacker with 
+access to the |k8s| cluster improper access to MongoDB instances. 
+Customers who do not use X.509 authentication, and those who do not use 
+the |k8s-op-short| to generate their X.509 certificates are unaffected.
+
+Common Weakness Enumeration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+CWE-295: Improper Certificate Validation
+CVSS score: 6.4
+CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
+
+Affected Versions
+~~~~~~~~~~~~~~~~~
+
+- 1.0, 1.1
+- 1.2.0 - 1.2.4
+- 1.3.0 - 1.3.1
+- 1.4.0 - 1.4.4
+
+Fixed Versions
+~~~~~~~~~~~~~~
+
+- 1.2.5
+- 1.4.5 and above
+
 .. _ent-op-1.2.4:
 
 |k8s-op-full| 1.2.4