Skip to content

[release-4.15] OCPBUGS-79889: Bump google.golang.org/grpc to v1.79.3 #531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ocp-sustaining-admins wants to merge 1 commit into
base: release-4.15
Choose a base branch
from
Open

[release-4.15] OCPBUGS-79889: Bump google.golang.org/grpc to v1.79.3 #531

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 17 additions & 15 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ require (
github.com/containers/storage v1.51.2
github.com/docker/distribution v2.8.3+incompatible
github.com/fsouza/go-dockerclient v1.10.0
github.com/go-logr/logr v1.3.0 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/opencontainers/runc v1.1.12
github.com/opencontainers/runtime-spec v1.1.0
Expand All @@ -23,7 +23,7 @@ require (
github.com/spf13/cobra v1.8.0
github.com/spf13/pflag v1.0.5
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
golang.org/x/sys v0.17.0
golang.org/x/sys v0.21.0
k8s.io/api v0.28.2
k8s.io/apimachinery v0.28.2
k8s.io/client-go v0.28.2
Expand Down Expand Up @@ -63,12 +63,12 @@ require (
github.com/godbus/dbus/v5 v5.1.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.0.1 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/go-intervals v0.0.2 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/google/uuid v1.4.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/mux v1.8.0 // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
Expand Down Expand Up @@ -115,16 +115,16 @@ require (
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
go.opencensus.io v0.24.0 // indirect
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
golang.org/x/crypto v0.19.0 // indirect
golang.org/x/mod v0.13.0 // indirect
golang.org/x/net v0.18.0 // indirect
golang.org/x/oauth2 v0.14.0 // indirect
golang.org/x/sync v0.5.0 // indirect
golang.org/x/term v0.17.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/crypto v0.24.0 // indirect
golang.org/x/mod v0.17.0 // indirect
golang.org/x/net v0.26.0 // indirect
golang.org/x/oauth2 v0.18.0 // indirect
Comment on lines +118 to +121
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify currently pinned versions in go.mod and query OSV for known vulns.

set -euo pipefail

echo "Pinned versions:"
rg -n '^\s*golang\.org/x/crypto\s+|^\s*golang\.org/x/oauth2\s+' go.mod

echo
echo "OSV query: golang.org/x/crypto@v0.24.0"
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' \
  -d '{"package":{"ecosystem":"Go","name":"golang.org/x/crypto"},"version":"v0.24.0"}' | jq '.vulns[]?.id'

echo
echo "OSV query: golang.org/x/oauth2@v0.18.0"
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' \
  -d '{"package":{"ecosystem":"Go","name":"golang.org/x/oauth2"},"version":"v0.18.0"}' | jq '.vulns[]?.id'

Repository: openshift/builder

Length of output: 448

Bump vulnerable dependencies to patched versions before merge.

Lines 118 and 121 pin versions with known security advisories:

Update to patched releases or document a justified suppression with reachability evidence.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

(GO-2024-3321)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto

(GO-2025-3487)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto/ssh/agent

(GO-2025-4116)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Unbounded memory consumption in golang.org/x/crypto/ssh

(GO-2025-4134)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent

(GO-2025-4135)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

(GHSA-f6x5-jh6r-wrfv)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange

(GHSA-hcg3-q754-cr77)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

(GHSA-j5w8-q4qc-rx2x)

[CRITICAL] 118-118: golang.org/x/crypto 0.24.0: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

(GHSA-v778-237x-gjrc)

[HIGH] 121-121: golang.org/x/oauth2 0.18.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2

(GO-2025-3488)

[HIGH] 121-121: golang.org/x/oauth2 0.18.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability

(GHSA-6v2p-p543-phr9)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 118 - 121, Update the vulnerable indirect module pins in
go.mod for golang.org/x/crypto and golang.org/x/oauth2 to patched releases:
replace the current versions for the symbols golang.org/x/crypto and
golang.org/x/oauth2 with the latest security-patched tags, run go get
<module>@<patched-version> and go mod tidy to update go.sum, then run your test
suite and static analyses; if you cannot upgrade, add a documented suppression
with reachability evidence and justification referencing those exact module
symbols.

golang.org/x/sync v0.7.0 // indirect
golang.org/x/term v0.21.0 // indirect
golang.org/x/text v0.16.0 // indirect
golang.org/x/time v0.5.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/grpc v1.58.3 // indirect
google.golang.org/grpc v1.62.1 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Show grpc require+replace entries proving effective dependency mapping.
set -euo pipefail
rg -n 'google\.golang\.org/grpc|openshift-sustaining/grpc-go' go.mod

Repository: openshift/builder

Length of output: 201

🌐 Web query:

Does github.com/openshift-sustaining/grpc-go tag v1.64.1-sec.1 include the fix for CVE-2026-33186, and what upstream grpc-go base version does it map to?

💡 Result:

No definitive evidence was found that the tag github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 includes the specific fix for CVE-2026-33186, nor what upstream google.golang.org/grpc version that tag maps to. What the sources do show: CVE-2026-33186 is fixed in google.golang.org/grpc v1.79.3 [1][2]. Multiple OpenShift Sustaining changes that remediate the CVE do so by bumping google.golang.org/grpc to v1.79.3 [3][4]. However, none of the retrieved sources contains information mapping the specific OpenShift Sustaining fork/tag v1.64.1-sec.1 to an upstream grpc-go base version, or confirms that that particular tag contains the CVE-2026-33186 patch.

Citations:

🏁 Script executed:

# Check if there's any documentation or reference in the repository about this fork
rg -n 'v1\.64\.1-sec|openshift-sustaining|CVE-2026-33186' --type-list | head -5
rg -n 'v1\.64\.1-sec|openshift-sustaining|CVE-2026-33186' -i

Repository: openshift/builder

Length of output: 1022

🌐 Web query:

What is the github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 fork and what upstream gRPC version does it patch?

💡 Result:

The repository github.com/openshift-sustaining/grpc-go (example tag v1.64.1-sec.1) is an OpenShift Sustaining-Team fork of the upstream gRPC Go implementation, used to carry security/patch changes while OpenShift is not yet ready to move to the corresponding upstream gRPC release train. However, in the sources I found, I could not locate a definitive upstream-version mapping specifically for tag v1.64.1-sec.1. What I can say with source-backed evidence: - OpenShift has used the openshift-sustaining/grpc-go fork in place of google.golang.org/grpc for CVE-related fixes (example PRs) [1]. - OpenShift PRs that reference “openshift-sustaining/grpc-go … sec” show the fork is used to avoid bumping to a newer upstream version immediately (example: “Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go … to avoid go version bump and fix CVE-2026-33186”) [1]. But the specific question you asked—“what upstream gRPC version does v1.64.1-sec.1 patch?”—requires a direct statement from the fork (tag release notes/README/changelog) or from a PR that explicitly states the upstream base version. The sources I retrieved did not include such a statement for v1.64.1-sec.1. If you want, I can do another targeted search specifically for the tag/release notes for v1.64.1-sec.1 inside openshift-sustaining/grpc-go, or look for an OpenShift PR that mentions exactly “v1.64.1-sec.1” and names the upstream base version.

Citations:

🌐 Web query:

OpenShift sustaining grpc-go v1.64.1-sec.1 CVE-2026-33186 security patch details

💡 Result:

CVE-2026-33186 is a critical authorization bypass vulnerability (CVSS 9.1) in google.golang.org/grpc versions prior to 1.79.3, caused by improper validation of the HTTP/2:path pseudo-header lacking a leading slash (e.g., "Service/Method" instead of "/Service/Method"). This allows bypassing path-based authorization interceptors like grpc/authz when deny rules use canonical paths and a fallback allow exists[1][2]. The official fix rejects non-slash paths with codes.Unimplemented[1].

Citations:

Version mismatch: PR title claims v1.79.3, but go.mod deploys v1.64.1-sec.1 fork.

The replace directive (line 240) points to github.com/openshift-sustaining/grpc-go v1.64.1-sec.1, a patched fork apparently based on upstream v1.64.1 (not v1.79.3 where CVE-2026-33186 is officially fixed). Confirm that this fork includes the intended security fix and update PR metadata to reflect the actual shipped version lineage.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 127, The go.mod currently uses a replace directive pointing
to github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 (a fork based on
v1.64.1) while the PR title claims v1.79.3; inspect the replace entry in go.mod
and verify whether that fork backports the CVE-2026-33186 fix from upstream
v1.79.3—if it does, update the PR title/description to state the actual forked
version and include proof (commit hash or changelog); if it does not, either
switch the dependency to upstream google.golang.org/grpc v1.79.3 or vendor a
proper patched fork that contains the fix, then update the go.mod
replace/directive and PR metadata accordingly.

google.golang.org/protobuf v1.33.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
Expand Down Expand Up @@ -196,8 +196,8 @@ require (
go.etcd.io/bbolt v1.3.8 // indirect
go.mongodb.org/mongo-driver v1.11.3 // indirect
golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
golang.org/x/tools v0.14.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 // indirect
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
k8s.io/apiextensions-apiserver v0.28.2 // indirect
tags.cncf.io/container-device-interface v0.6.2 // indirect
Expand Down Expand Up @@ -236,3 +236,5 @@ replace (
k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.28.2
k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.28.2
)

replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.64.1-sec.1
2,398 changes: 2,362 additions & 36 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

73 changes: 43 additions & 30 deletions vendor/github.com/go-logr/logr/README.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

33 changes: 33 additions & 0 deletions vendor/github.com/go-logr/logr/context.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

49 changes: 49 additions & 0 deletions vendor/github.com/go-logr/logr/context_noslog.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

83 changes: 83 additions & 0 deletions vendor/github.com/go-logr/logr/context_slog.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading