8000 [release/2.0] silence govulncheck false positives by AkihiroSuda · Pull Request #11571 · containerd/containerd · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[release/2.0] silence govulncheck false positives #11571

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Mar 19, 2025
Merged

[release/2.0] silence govulncheck false positives #11571

merged 3 commits into from
Mar 19, 2025

Conversation

AkihiroSuda
Copy link
Member

govulncheck -mode=binary detected the following vulns, but -mode=source says "your code doesn't appear to call these vulnerabilities."

=== Symbol Results ===

Vulnerability #1: GO-2025-3503
    HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2025-3503
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.33.0
    Fixed in: golang.org/x/net@v0.36.0
    Vulnerable symbols found:
      #1: httpproxy.config.useProxy
      #2: httpproxy.domainMatch.match
      #3: proxy.Dial
      #4: proxy.FromEnvironment
      #5: proxy.FromEnvironmentUsing
      Use '-show traces' to see the other 3 found symbols

Vulnerability #2: GO-2025-3488
    Unexpected memory consumption during token parsing in golang.org/x/oauth2
  More info: https://pkg.go.dev/vuln/GO-2025-3488
  Module: golang.org/x/oauth2
    Found in: golang.org/x/oauth2@v0.23.0
    Fixed in: golang.org/x/oauth2@v0.27.0
    Vulnerable symbols found:
      #1: jws.Verify

Vulnerability #3: GO-2025-3487
    Potential denial of service in golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2025-3487
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.35.0
    Vulnerable symbols found:
      #1: ssh.Client.Dial
      #2: ssh.Client.DialContext
      #3: ssh.Client.DialTCP
      #4: ssh.Client.Listen
      #5: ssh.Client.ListenTCP
      Use '-show traces' to see the other 48 found symbols

Vulnerability #4: GO-2025-3485
    DoS in go-jose Parsing in github.com/go-jose/go-jose
  More info: https://pkg.go.dev/vuln/GO-2025-3485
  Module: github.com/go-jose/go-jose/v4
    Found in: github.com/go-jose/go-jose/v4@v4.0.4
    Fixed in: github.com/go-jose/go-jose/v4@v4.0.5
    Vulnerable symbols found:
      #1: jose.ParseEncrypted
      #2: jose.ParseEncryptedCompact
      #3: jose.ParseSignedCompact

Your code is affected by 4 vulnerabilities from 4 modules.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.

@AkihiroSuda
go.mod: golang.org/x/net v0.37.0
6df1ea0 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
@AkihiroSuda
go.mod: golang.org/x/oauth2 v0.28.0
2b9e6a2 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
@AkihiroSuda
go.mod: github.com/go-jose/go-jose/v4
4cfb894 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
@github-project-automation github-project-automation bot moved this to Needs Triage in Pull Request Review Mar 19, 2025
@dosubot dosubot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 19, 2025
@AkihiroSuda
Copy link
Member Author

I also wonder if we can configure dependabot to automate this kind of PRs

@djdongjin
Copy link
Member

#11571 (comment)
@AkihiroSuda for main branch, we can let dependabot create a PR from this page:

https://github.com/containerd/containerd/security/dependabot

E.g., I just created these 2
#11572
#11573

djdongjin
djdongjin reviewed Mar 19, 2025
View reviewed changes
Copy link
Member
@djdongjin djdongjin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to update this on main branch.

containerd/api/go.mod

Lines 3 to 4 in 57d29ee

go 1.21

@djdongjin
Copy link
Member

Actually I think it's doable to let dependabot open security PRs automatically.

https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#enabling-or-disabling-dependabot-security-updates-for-an-individual-repository

@AkihiroSuda
Copy link
Member Author
AkihiroSuda commented Mar 19, 2025 •
edited
Loading

https://github.com/containerd/containerd/security/dependabot

This seems to only work for the main branch?

@djdongjin
Copy link
Member

This seems to only work for the main branch?

Yes that looks like a known limitation.

https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/customizing-dependabot-security-prs#:~:text=Dependabot%20raises%20pull%20requests%20for%20security%20updates%20against%20the%20default%20branch%20only.

Probably still useful. At least those PRs can be automated in main branch by dependabot, and we can cherrypick to release branches.

@github-project-automation github-project-automation bot moved this from Needs Triage to Review In Progress in Pull Request Review Mar 19, 2025
@estesp estesp merged commit c0d93d2 into containerd:release/2.0 Mar 19, 2025
58 checks passed
@github-project-automation github-project-automation bot moved this from Review In Progress to Done in Pull Request Review Mar 19, 2025
@djdongjin djdongjin mentioned this pull request Mar 19, 2025
bump golang.org/x/net from 0.33.0 to 0.37.0 #11574
Merged
@dmcgowan dmcgowan mentioned this pull request Apr 17, 2025
Merged
@github-actions github-actions bot mentioned this pull request Apr 20, 2025
Open
Mengkzhaoyun pushed a commit to open-beagle/containerd that referenced this pull request Jun 12, 2025
Merge tag 'v2.0.5' into release-v2.0
b76206b 
containerd 2.0.5

Welcome to the v2.0.5 release of containerd!

The fifth patch release for containerd 2.0 includes various bug fixes and updates.

* Update go to 1.23.8 ([#11717](containerd/containerd#11717))

* Update ImageService to delete images synchronously ([#11599](containerd/containerd#11599))

* Prevent panic on zero length push ([#11698](containerd/containerd#11698))
* Set default differ for the default unpack config of transfer service ([#11688](containerd/containerd#11688))

* Remove invalid error log when stopping container after containerd restart ([#11621](containerd/containerd#11621))
* Update taskOptions based on runtimeOptions when creating a task ([#11618](containerd/containerd#11618))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Akihiro Suda
* Akhil Mohan
* Derek McGowan
* Phil Estes
* Wei Fu
* Iceber Gu
* Austin Vazquez
* Maksym Pavlenko
* Cesar Talledo
* Henry Wang
* Jin Dong
* Krisztian Litkey
* Yang Yang
<details><summary>33 commits</summary>
<p>

* Update go to 1.23.8 ([#11717](containerd/containerd#11717))
  * [`5bcf0a95e`](containerd/containerd@5bcf0a9) use go1.23.8 as the default go version
  * [`4838f33f7`](containerd/containerd@4838f33) update to go 1.24.2, 1.23.8
* Prepare release notes for v2.0.5 ([#11713](containerd/containerd#11713))
  * [`a8082cd60`](containerd/containerd@a8082cd) Prepare release notes for v2.0.5
* Disable criu test on arm64 ([#11710](containerd/containerd#11710))
  * [`58b715ad8`](containerd/containerd@58b715a) Disable arm64 criu testing in GH Actions
  * [`b4a53e826`](containerd/containerd@b4a53e8) disable portmap test in ubuntu-22 to make CI happy
  * [`4bcf472de`](containerd/containerd@4bcf472) add option to skip tests in critest
* Prevent panic on zero length push ([#11698](containerd/containerd#11698))
  * [`8a638b71a`](containerd/containerd@8a638b7) Prevent panic in Docker pusher.
* Set default differ for the default unpack config of transfer service ([#11688](containerd/containerd#11688))
  * [`84d9658c3`](containerd/containerd@84d9658) Set default differ for the default unpack config of transfer service
* ci: update GitHub Actions release runner to ubuntu-24.04 ([#11703](containerd/containerd#11703))
  * [`b184a97d3`](containerd/containerd@b184a97) ci: update GitHub Actions release runner to ubuntu-24.04
* Remove invalid error log when stopping container after containerd restart ([#11621](containerd/containerd#11621))
  * [`e04543db0`](containerd/containerd@e04543d) use shimCtx for fifo copy
* Update taskOptions based on runtimeOptions when creating a task ([#11618](containerd/containerd#11618))
  * [`9f46e7a44`](containerd/containerd@9f46e7a) integration/client: add tests for TaskOptions is not empty
  * [`8a16a6a04`](containerd/containerd@8a16a6a) prefer task options for PluginInfo request
  * [`a183b2d23`](containerd/containerd@a183b2d) update taskOptions based on runtimeOptions when creating a task
* Update ImageService to delete images synchronously ([#11599](containerd/containerd#11599))
  * [`091143135`](containerd/containerd@0911431) *: CRIImageService should delete image synchronously
* Update runc binary to v1.2.6 ([#11583](containerd/containerd#11583))
  * [`c2372c072`](containerd/containerd@c2372c0) Update runc binary to v1.2.6
* go.{mod,sum}: bump CDI deps to stable v1.0.0. ([#11566](containerd/containerd#11566))
  * [`e8506511b`](containerd/containerd@e850651) go.{mod,sum}: bump CDI deps to stable v1.0.0.
* silence govulncheck false positives ([#11571](containerd/containerd#11571))
  * [`4cfb89430`](containerd/containerd@4cfb894) go.mod: github.com/go-jose/go-jose/v4
  * [`2b9e6a29d`](containerd/containerd@2b9e6a2) go.mod: golang.org/x/oauth2 v0.28.0
  * [`6df1ea0d9`](containerd/containerd@6df1ea0) go.mod: golang.org/x/net v0.37.0
* Fix CI lint error (cherry-picked #11555) ([#11567](containerd/containerd#11567))
  * [`16f20abdf`](containerd/containerd@16f20ab) Fix CI lint error
</p>
</details>

* **github.com/go-jose/go-jose/v4**                     v4.0.4 -> v4.0.5
* **golang.org/x/crypto**                               v0.31.0 -> v0.36.0
* **golang.org/x/net**                                  v0.33.0 -> v0.37.0
* **golang.org/x/oauth2**                               v0.23.0 -> v0.28.0
* **golang.org/x/sync**                                 v0.10.0 -> v0.12.0
* **golang.org/x/sys**                                  v0.28.0 -> v0.31.0
* **golang.org/x/term**                                 v0.27.0 -> v0.30.0
* **golang.org/x/text**                                 v0.21.0 -> v0.23.0
* **tags.cncf.io/container-device-interface**           v0.8.1 -> v1.0.0
* **tags.cncf.io/container-device-interface/specs-go**  v0.8.0 -> v1.0.0

Previous release can be found at [v2.0.4](https://github.com/containerd/containerd/releases/tag/v2.0.4)
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@djdongjin djdongjin djdongjin approved these changes

@estesp estesp estesp approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code size/XXL
Projects
Pull Request Review
Archived in project
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@AkihiroSuda @djdongjin @estesp @k8s-ci-robot
0