SREP-3895 CVEs remediation, image rebuild by diakovnec · Pull Request #474 · openshift/managed-cluster-validating-webhooks

diakovnec · 2026-03-25T03:00:16Z

This PR addresses multiple CVEs that exist in the base image:

Before:
59 High/Critical stdlib CVEs (due to Go 1.18.1, 1.24.7, 1.25.7 mix)
After:
1 High stdlib CVE (CVE-2026-25679 in Go 1.25.7)
58 CVEs fixed! ✅
Remaining CVE:
CVE-2026-25679: Requires Go 1.25.8 or 1.26.1 (not yet available)
Low exploitability (< 0.1% in the 8th percentile)

grype registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.21 | grep -E "High|Critical" | grep stdlib 
 ✔ Loaded image                                                                                                      registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.21 
 ✔ Parsed image                                                                                                                    sha256:1d68e77530951dc03573ba5fbcdb1c0587be8229302bc1c012d1bd2d93d6cbe5 
 ✔ Cataloged contents                                                                                                                     e018a25017deb89825c0a9984fd3f8bca659eaa3f1476318d0740715cbcde0dd 
   ├── ✔ Packages                        [627 packages]  
   ├── ✔ Executables                     [1,762 executables]  
   ├── ✔ File metadata                   [35,321 locations]  
   └── ✔ File digests                    [35,321 files]  
 ✔ Scanned for vulnerabilities     [1139 vulnerability matches]  
   ├── by severity: 11 critical, 109 high, 2657 medium, 2071 low, 18 negligible (34 unknown)
   └── by status:   167 fixed, 4733 not-fixed, 3761 ignored 
stdlib                        go1.18.1                 *1.20.10, 1.21.3               go-module  CVE-2023-44487       High        94.4% (99th)   78.8   (kev)  
stdlib                        go1.18.1                 *1.21.9, 1.22.2                go-module  CVE-2023-45288       High        71.5% (98th)   53.6          
stdlib                        go1.18.1                 *1.21.8, 1.22.1                go-module  CVE-2024-24784       High        1.5% (80th)    1.1           
stdlib                        go1.18.1                 *1.21.12, 1.22.5               go-module  CVE-2024-24791       High        1.0% (77th)    0.8           
stdlib                        go1.18.1                 *1.19.8, 1.20.3                go-module  CVE-2023-24538       Critical    0.6% (70th)    0.6           
stdlib                        go1.18.1                 1.21.0-0                       go-module  CVE-2023-24531       Critical    0.5% (64th)    0.5           
stdlib                        go1.18.1                 *1.19.10, 1.20.5               go-module  CVE-2023-29405       Critical    0.3% (55th)    0.3           
stdlib                        go1.18.1                 *1.19.9, 1.20.4                go-module  CVE-2023-24540       Critical    0.2% (47th)    0.2           
stdlib                        go1.18.1                 *1.22.7, 1.23.1                go-module  CVE-2024-34156       High        0.3% (53rd)    0.2           
stdlib                        go1.18.1                 1.19.6                         go-module  CVE-2022-41723       High        0.3% (50th)    0.2           
stdlib                        go1.18.1                 *1.21.11, 1.22.4               go-module  CVE-2024-24790       Critical    0.2% (38th)    0.2           
stdlib                        go1.18.1                 *1.23.8, 1.24.2                go-module  CVE-2025-22871       Critical    0.2% (37th)    0.2           
stdlib                        go1.18.1                 1.20.0                         go-module  CVE-2023-45287       High        0.2% (40th)    0.1           
stdlib                        go1.18.1                 *1.22.7, 1.23.1                go-module  CVE-2024-34158       High        0.2% (37th)    0.1           
stdlib                        go1.18.1                 *1.19.10, 1.20.5               go-module  CVE-2023-29402       Critical    0.1% (31st)    0.1           
stdlib                        go1.18.1                 *1.19.8, 1.20.3                go-module  CVE-2023-24534       High        0.1% (33rd)    0.1           
stdlib                        go1.18.1                 1.17.13, *1.18.5               go-module  CVE-2022-32189       High        0.1% (30th)    < 0.1         
stdlib                        go1.18.1                 *1.19.10, 1.20.5               go-module  CVE-2023-29404       Critical    < 0.1% (24th)  < 0.1         
stdlib                        go1.18.1                 1.18.6                         go-module  CVE-2022-27664       High        0.1% (27th)    < 0.1         
stdlib                        go1.18.1                 1.17.12, *1.18.4               go-module  CVE-2022-30632       High        < 0.1% (26th)  < 0.1         
stdlib                        go1.18.1                 1.17.12, *1.18.4               go-module  CVE-2022-30633       High        < 0.1% (26th)  < 0.1         
stdlib                        go1.18.1                 1.17.12, *1.18.4               go-module  CVE-2022-30635       High        < 0.1% (26th)  < 0.1         
stdlib                        go1.18.1                 *1.19.8, 1.20.3                go-module  CVE-2023-24536       High        < 0.1% (21st)  < 0.1         
stdlib                        go1.18.1                 *1.19.9, 1.20.4                go-module  CVE-2023-24539       High        < 0.1% (20th)  < 0.1         
stdlib                        go1.18.1                 1.19.6                         go-module  CVE-2022-41725       High        < 0.1% (19th)  < 0.1         
stdlib                        go1.18.1                 *1.20.9, 1.21.2                go-module  CVE-2023-39323       High        < 0.1% (18th)  < 0.1         
stdlib                        go1.18.1                 1.17.11, *1.18.3               go-module  CVE-2022-30580       High        < 0.1% (18th)  < 0.1         
stdlib                        go1.18.1                 *1.20.12, 1.21.5               go-module  CVE-2023-45285       High        < 0.1% (17th)  < 0.1         
stdlib                        go1.18.1                 *1.19.9, 1.20.4                go-module  CVE-2023-29400       High        < 0.1% (14th)  < 0.1         
stdlib                        go1.18.1                 1.17.12, *1.18.4               go-module  CVE-2022-30631       High        < 0.1% (12th)  < 0.1         
stdlib                        go1.18.1                 1.17.12, *1.18.4               go-module  CVE-2022-30630       High        < 0.1% (11th)  < 0.1         
stdlib                        go1.18.1                 *1.24.12, 1.25.6               go-module  CVE-2025-61726       High        < 0.1% (9th)   < 0.1         
stdlib                        go1.24.7                 *1.24.12, 1.25.6               go-module  CVE-2025-61726       High        < 0.1% (9th)   < 0.1         
stdlib                        go1.18.1                 *1.18.7, 1.19.2                go-module  CVE-2022-2880        High        < 0.1% (8th)   < 0.1         
stdlib                        go1.18.1                 *1.25.8, 1.26.1                go-module  CVE-2026-25679       High        < 0.1% (8th)   < 0.1         
stdlib                        go1.24.7                 *1.25.8, 1.26.1                go-module  CVE-2026-25679       High        < 0.1% (8th)   < 0.1         
stdlib                        go1.25.7                 *1.25.8, 1.26.1                go-module  CVE-2026-25679       High        < 0.1% (8th)   < 0.1         
stdlib                        go1.18.1                 *1.24.8, 1.25.2                go-module  CVE-2025-61725       High        < 0.1% (8th)   < 0.1         
stdlib                        go1.24.7                 *1.24.8, 1.25.2                go-module  CVE-2025-61725       High        < 0.1% (8th)   < 0.1         
stdlib                        go1.18.1                 *1.24.8, 1.25.2                go-module  CVE-2025-61723       High        < 0.1% (7th)   < 0.1         
stdlib                        go1.24.7                 *1.24.8, 1.25.2                go-module  CVE-2025-61723       High        < 0.1% (7th)   < 0.1         
stdlib                        go1.18.1                 *1.24.11, 1.25.5               go-module  CVE-2025-61729       High        < 0.1% (5th)   < 0.1         
stdlib                        go1.24.7                 *1.24.11, 1.25.5               go-module  CVE-2025-61729       High        < 0.1% (5th)   < 0.1         
stdlib                        go1.18.1                 *1.24.13, 1.25.7, 1.26.0-rc.3  go-module  CVE-2025-68121       Critical    < 0.1% (3rd)   < 0.1         
stdlib                        go1.24.7                 *1.24.13, 1.25.7, 1.26.0-rc.3  go-module  CVE-2025-68121       Critical    < 0.1% (3rd)   < 0.1         
stdlib                        go1.18.1                 1.19.6                         go-module  CVE-2022-41724       High        < 0.1% (5th)   < 0.1         
stdlib                        go1.18.1                 *1.18.7, 1.19.2                go-module  CVE-2022-41715       High        < 0.1% (3rd)   < 0.1         
stdlib                        go1.18.1                 *1.18.7, 1.19.2                go-module  CVE-2022-2879        High        < 0.1% (3rd)   < 0.1         
stdlib                        go1.18.1                 1.17.12, *1.18.4               go-module  CVE-2022-28131       High        < 0.1% (3rd)   < 0.1         
stdlib                        go1.18.1                 *1.19.8, 1.20.3                go-module  CVE-2023-24537       High        < 0.1% (2nd)   < 0.1         
stdlib                        go1.18.1                 *1.24.9, 1.25.3                go-module  CVE-2025-58187       High        < 0.1% (2nd)   < 0.1         
stdlib                        go1.24.7                 *1.24.9, 1.25.3                go-module  CVE-2025-58187       High        < 0.1% (2nd)   < 0.1         
stdlib                        go1.18.1                 *1.23.12, 1.24.6               go-module  CVE-2025-47907       High        < 0.1% (1st)   < 0.1         
stdlib                        go1.18.1                 *1.24.12, 1.25.6               go-module  CVE-2025-61731       High        < 0.1% (1st)   < 0.1         
stdlib                        go1.24.7                 *1.24.12, 1.25.6               go-module  CVE-2025-61731       High        < 0.1% (1st)   < 0.1         
stdlib                        go1.18.1                 *1.19.10, 1.20.5               go-module  CVE-2023-29403       High        < 0.1% (0th)   < 0.1         
stdlib                        go1.18.1                 *1.24.13, 1.25.7               go-module  CVE-2025-61732       High        < 0.1% (0th)   < 0.1         
stdlib                        go1.24.7                 *1.24.13, 1.25.7               go-module  CVE-2025-61732       High        < 0.1% (0th)   < 0.1         
stdlib                        go1.18.1                 *1.24.8, 1.25.2                go-module  CVE-2025-58188       High        < 0.1% (0th)   < 0.1         
stdlib                        go1.24.7                 *1.24.8, 1.25.2                go-module  CVE-2025-58188       High        < 0.1% (0th)   < 0.1         
stdlib                        go1.18.1                 *1.23.11, 1.24.5               go-module  CVE-2025-4674        High

openshift-ci · 2026-03-25T03:00:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: diakovnec

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [diakovnec]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-03-25T03:00:32Z

Warning

Rate limit exceeded

@diakovnec has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 50 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: db074604-baaf-4cad-a14b-fc7d9b5b56b2

📥 Commits

Reviewing files that changed from the base of the PR and between b0a3a6f and bf9eb05.

📒 Files selected for processing (2)

build/Dockerfile
go.mod

Walkthrough

The pull request updates the Go toolchain version from 1.25.3 to 1.25.7 in go.mod. The Docker base image for the builder stage is also updated from an OpenShift release Go builder image to a Red Hat UBI9 Go toolset image at version 1.25.7.

Changes

Cohort / File(s)	Summary
Toolchain and Dependencies `build/Dockerfile`, `go.mod`	Docker base image updated from OpenShift release Go builder to Red Hat UBI9 Go toolset (1.25.7). Go module version directive incremented from 1.25.3 to 1.25.7.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Makefile`:
- Line 20: The Makefile currently sets SYNCSET_GENERATOR_IMAGE to a floating tag
(SYNCSET_GENERATOR_IMAGE :=
registry.ci.openshift.org/openshift/release:golang-1.25); update this to an
immutable digest-pinned reference that matches the Go 1.25.7 toolchain used
elsewhere (e.g.,
registry.ci.openshift.org/openshift/release:<exact-tag>@sha256:<digest>),
replacing the floating tag with the exact tag@sha256 value so builds are
reproducible and consistent with go.mod/build/Dockerfile; ensure
SYNCSET_GENERATOR_IMAGE is the only changed symbol and verify the digest
corresponds to the Go 1.25.7 image.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ade8af48-1d15-4b32-bc0b-8eab50cb1aaa

📥 Commits

Reviewing files that changed from the base of the PR and between 58bfd88 and 1c5834b.

📒 Files selected for processing (3)

Makefile
build/Dockerfile
go.mod

coderabbitai · 2026-03-25T03:04:30Z

Makefile

 PKG_IMG ?= $(IMG_REGISTRY)/$(IMG_ORG)/${BASE_PKG_IMG}

-SYNCSET_GENERATOR_IMAGE := registry.ci.openshift.org/openshift/release:golang-1.21
+SYNCSET_GENERATOR_IMAGE := registry.ci.openshift.org/openshift/release:golang-1.25


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== Current toolchain/image references ==" rg -n '^(go [0-9]+\.[0-9]+\.[0-9]+|SYNCSET_GENERATOR_IMAGE|ARG BASE_IMAGE)' go.mod Makefile build/Dockerfile echo python - <<'PY' import re, pathlib mk = pathlib.Path("Makefile").read_text() m = re.search(r'^SYNCSET_GENERATOR_IMAGE\s*:?=\s*(\S+)', mk, re.M) if not m: raise SystemExit("SYNCSET_GENERATOR_IMAGE not found") img = m.group(1) print(f"SYNCSET_GENERATOR_IMAGE={img}") print(f"uses_digest={'@sha256:' in img}") print(f"has_patch_tag={bool(re.search(r':[^\s:@]*\\d+\\.\\d+\\.\\d+', img))}") PY

Repository: openshift/managed-cluster-validating-webhooks

Length of output: 612

🏁 Script executed:

#!/bin/bash set -euo pipefail # Correct Python script to verify SYNCSET_GENERATOR_IMAGE details python3 <<'PY' import re import pathlib mk = pathlib.Path("Makefile").read_text() m = re.search(r'^SYNCSET_GENERATOR_IMAGE\s*:?=\s*(\S+)', mk, re.MULTILINE) if not m: raise SystemExit("SYNCSET_GENERATOR_IMAGE not found") img = m.group(1) print(f"SYNCSET_GENERATOR_IMAGE={img}") print(f"has_digest={('@sha256:' in img)}") # Check for patch-level tag has_patch = bool(re.search(r':\d+\.\d+\.\d+', img)) print(f"has_patch_version={has_patch}") PY # Search for other image references in Makefile or CI configs echo "== Looking for other image pins to establish pattern ==" rg -n 'IMAGE.*:=|@sha256:|golang-1\.' Makefile .github/ ci/ --type-list | head -20 || echo "CI config search completed"

Repository: openshift/managed-cluster-validating-webhooks

Length of output: 699

🏁 Script executed:

#!/bin/bash set -euo pipefail # Find CI/workflow files echo "== CI Configuration Files ==" fd -e yaml -e yml -e sh | grep -E '(\.github|\.prow|ci|workflow)' | head -20 # Look at Makefile context around line 20 echo echo "== Makefile context (lines 15-25) ==" sed -n '15,25p' Makefile # Search for any other registry.ci.openshift.org references echo echo "== Other registry.ci references ==" rg 'registry\.ci\.openshift\.org' -B 2 -A 2

Repository: openshift/managed-cluster-validating-webhooks

Length of output: 117

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== Makefile context (lines 1-30) ==" head -30 Makefile echo echo "== Search for any image/tag patterns ==" rg 'registry\.' Makefile

Repository: openshift/managed-cluster-validating-webhooks

Length of output: 1095

Pin the SYNCSET_GENERATOR_IMAGE to an immutable digest reference.

Line 20 uses a floating tag (golang-1.25). This can silently drift from the validated CVE-remediated toolchain pinned in go.mod (1.25.7) and build/Dockerfile (1.25.7-1774351791), breaking reproducibility and weakening security guarantees for generated SyncSet artifacts and tests.

Replace the floating tag with a specific digest-pinned reference from the OpenShift CI registry (e.g., registry.ci.openshift.org/openshift/release:<specific-tag>@sha256:<digest>). The exact digest should reference the same Go 1.25.7 toolchain patch used elsewhere in the build.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@Makefile` at line 20, The Makefile currently sets SYNCSET_GENERATOR_IMAGE to a floating tag (SYNCSET_GENERATOR_IMAGE := registry.ci.openshift.org/openshift/release:golang-1.25); update this to an immutable digest-pinned reference that matches the Go 1.25.7 toolchain used elsewhere (e.g., registry.ci.openshift.org/openshift/release:<exact-tag>@sha256:<digest>), replacing the floating tag with the exact tag@sha256 value so builds are reproducible and consistent with go.mod/build/Dockerfile; ensure SYNCSET_GENERATOR_IMAGE is the only changed symbol and verify the digest corresponds to the Go 1.25.7 image.

diakovnec · 2026-03-25T03:19:07Z

/retest

openshift-ci · 2026-03-25T03:25:03Z

@diakovnec: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot requested review from Mhodesty and smarthall March 25, 2026 03:00

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 25, 2026

coderabbitai bot reviewed Mar 25, 2026

View reviewed changes

diakovnec force-pushed the SREP-3895 branch from 1c5834b to b0a3a6f Compare March 25, 2026 03:07

SREP-3895 CVEs remediation, image rebuild

bf9eb05

diakovnec force-pushed the SREP-3895 branch from b0a3a6f to bf9eb05 Compare March 25, 2026 03:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SREP-3895 CVEs remediation, image rebuild#474

SREP-3895 CVEs remediation, image rebuild#474
diakovnec wants to merge 1 commit intoopenshift:masterfrom
diakovnec:SREP-3895

diakovnec commented Mar 25, 2026

Uh oh!

openshift-ci bot commented Mar 25, 2026

Uh oh!

coderabbitai bot commented Mar 25, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Mar 25, 2026

Uh oh!

diakovnec commented Mar 25, 2026

Uh oh!

openshift-ci bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

diakovnec commented Mar 25, 2026

Uh oh!

openshift-ci bot commented Mar 25, 2026

Uh oh!

coderabbitai bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

diakovnec commented Mar 25, 2026

Uh oh!

openshift-ci bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai bot commented Mar 25, 2026 •

edited

Loading