Skip to content

[Release-4.19] OCPBUGS-80485,OCPBUGS-80484: Update grpc to v1.75.1-sec.1 to fix CVE-2026-33186 #731

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MrSanketkumar wants to merge 1 commit into
base: release-4.19
Choose a base branch
from
Open

[Release-4.19] OCPBUGS-80485,OCPBUGS-80484: Update grpc to v1.75.1-sec.1 to fix CVE-2026-33186 #731

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Empty file added deps.diff
View file
Open in desktop
Empty file.
38 changes: 20 additions & 18 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ require (
github.com/containerd/containerd v1.7.27
github.com/containers/image/v5 v5.35.0
github.com/fsnotify/fsnotify v1.9.0
github.com/go-logr/logr v1.4.2
github.com/go-logr/logr v1.4.3
github.com/google/go-cmp v0.7.0
github.com/google/go-containerregistry v0.20.3
github.com/gorilla/handlers v1.5.2
Expand All @@ -23,9 +23,9 @@ require (
github.com/spf13/cobra v1.9.1
github.com/stretchr/testify v1.10.0
golang.org/x/exp v0.0.0-20250228200357-dead58393ab7
golang.org/x/mod v0.24.0
golang.org/x/sync v0.13.0
golang.org/x/tools v0.32.0
golang.org/x/mod v0.25.0
golang.org/x/sync v0.15.0
golang.org/x/tools v0.33.0
gopkg.in/yaml.v2 v2.4.0
helm.sh/helm/v3 v3.17.3
k8s.io/api v0.32.3
Expand All @@ -48,7 +48,7 @@ require (
)

require (
cel.dev/expr v0.19.1 // indirect
cel.dev/expr v0.24.0 // indirect
dario.cat/mergo v1.0.1 // indirect
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
Expand Down Expand Up @@ -103,7 +103,7 @@ require (
github.com/go-git/go-billy/v5 v5.6.1 // indirect
github.com/go-git/go-git/v5 v5.13.1 // indirect
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
github.com/go-jose/go-jose/v4 v4.1.1 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What is the first patched version of github.com/go-jose/go-jose/v4 for GHSA-78h2-9frx-2jm8, and is v4.1.1 affected?

💡 Result:

The first patched version of github.com/go-jose/go-jose/v4 for GHSA-78h2-9frx-2jm8 is v4.1.4 [1]. Yes, v4.1.1 is affected (the advisory lists affected versions as < 4.1.4) [1].

Citations:

Bump go-jose to v4.1.4 to address GHSA-78h2-9frx-2jm8.

Line 106 pins github.com/go-jose/go-jose/v4 to v4.1.1, which is vulnerable to GHSA-78h2-9frx-2jm8. Upgrade to v4.1.4 or later before merge.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 106-106: github.com/go-jose/go-jose/v4 4.1.1: Go JOSE Panics in JWE decryption

(GHSA-78h2-9frx-2jm8)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 106, Update the pinned module version for
github.com/go-jose/go-jose/v4 from v4.1.1 to v4.1.4 (or later) to remediate
GHSA-78h2-9frx-2jm8; after changing the version entry for
github.com/go-jose/go-jose/v4, run the Go tooling (e.g., go get
github.com/go-jose/go-jose/v4@v4.1.4 and go mod tidy) to refresh go.mod and
go.sum so the lockfile and transitive deps are updated.

github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
github.com/go-openapi/errors v0.22.1 // indirect
Expand Down Expand Up @@ -214,24 +214,24 @@ require (
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
go.opentelemetry.io/otel v1.34.0 // indirect
go.opentelemetry.io/otel v1.37.0 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

`What are the first patched versions for:

  1. GHSA-mh2q-q3fh-2475 in go.opentelemetry.io/otel
  2. GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx (GO-2026-4394) in go.opentelemetry.io/otel/sdk?
    Are versions 1.37.0 affected?`

💡 Result:

  1. GHSA-mh2q-q3fh-2475 (go.opentelemetry.io/otel) - First patched versions: v1.41.0 for go.opentelemetry.io/otel (advisory lists patched version v1.41.0) [1][2]. - Versions affected: >= v1.36.0, <= v1.40.0 [1]. 2) GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx (GO-2026-4394) (go.opentelemetry.io/otel/sdk) - First patched version: v1.40.0 for go.opentelemetry.io/otel/sdk (pkg.go.dev vuln entry shows affected versions are “from v1.21.0 before v1.40.0”) [3]. - Another corroboration from downstream dependency update indicates sdk@v1.36.0 is replaced with sdk@v1.40.0 to resolve GO-2026-4394 [4]. Are versions 1.37.0 affected? - For GHSA-mh2q-q3fh-2475: yes. The advisory states affected versions are >= v1.36.0 and <= v1.40.0, which includes 1.37.0 [1]. - For GO-2026-4394 (GHSA-9h8m-3fm2-qjrq / GHSA-hfvc-g4fc-pqhx): yes, because affected versions are “from v1.21.0 before v1.40.0”, which includes 1.37.0 [3].

Citations:

Upgrade go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk to patched versions.

Lines 217 and 221 contain vulnerable versions that are affected by:

Upgrade to:

  • go.opentelemetry.io/otel → v1.41.0 or later
  • go.opentelemetry.io/otel/sdk → v1.40.0 or later
🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 217-217: go.opentelemetry.io/otel 1.37.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)

(GHSA-mh2q-q3fh-2475)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 217, Update the vulnerable OpenTelemetry module versions in
go.mod by bumping the module entries for go.opentelemetry.io/otel and
go.opentelemetry.io/otel/sdk to patched releases; specifically change the
go.opentelemetry.io/otel line to v1.41.0 or later and the
go.opentelemetry.io/otel/sdk line to v1.40.0 or later, then run `go mod
tidy`/`go get` to resolve and verify the updated dependency graph and ensure
builds/tests pass; target the module names "go.opentelemetry.io/otel" and
"go.opentelemetry.io/otel/sdk" when making the edits.

go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0 // indirect
go.opentelemetry.io/otel/metric v1.34.0 // indirect
go.opentelemetry.io/otel/sdk v1.34.0 // indirect
go.opentelemetry.io/otel/trace v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.37.0 // indirect
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
go.opentelemetry.io/otel/trace v1.37.0 // indirect
go.opentelemetry.io/proto/otlp v1.4.0 // indirect
golang.org/x/crypto v0.37.0 // indirect
golang.org/x/net v0.39.0 // indirect
golang.org/x/oauth2 v0.29.0 // indirect
golang.org/x/sys v0.32.0 // indirect
golang.org/x/term v0.31.0 // indirect
golang.org/x/text v0.24.0 // indirect
golang.org/x/crypto v0.39.0 // indirect
golang.org/x/net v0.41.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sys v0.33.0 // indirect
golang.org/x/term v0.32.0 // indirect
golang.org/x/text v0.26.0 // indirect
golang.org/x/time v0.11.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/grpc v1.71.0 // indirect
google.golang.org/protobuf v1.36.6 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
Expand Down Expand Up @@ -307,3 +307,5 @@ replace k8s.io/mount-utils => k8s.io/mount-utils v0.32.3
replace k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.32.3

replace k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.32.3

replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.75.1-sec.1
2,084 changes: 2,028 additions & 56 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

26 changes: 14 additions & 12 deletions openshift/default-catalog-consistency/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,8 @@ require (
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-git/go-billy/v5 v5.6.2 // indirect
github.com/go-git/go-git/v5 v5.16.0 // indirect
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-jose/go-jose/v4 v4.1.1 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What is the first patched version for GHSA-78h2-9frx-2jm8 in github.com/go-jose/go-jose/v4, and is v4.1.1 affected?

💡 Result:

First patched version for GHSA-78h2-9frx-2jm8 in github.com/go-jose/go-jose/v4 is v4.1.4, and v4.1.1 is affected (because the advisory states all versions < 4.1.4 are affected, and 4.1.4 is the first patched/fixed version). [1] Conclusion on v4.1.1: Yes, v4.1.1 is affected; it falls under the advisory’s affected range “< 4.1.4”, and the patched versions list starts at “4.1.4”. [1]

Citations:

Upgrade github.com/go-jose/go-jose/v4 to a patched version.

Line 46 pins github.com/go-jose/go-jose/v4 to v4.1.1, which is affected by GHSA-78h2-9frx-2jm8. Bump to v4.1.4 or later before merge.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openshift/default-catalog-consistency/go.mod` at line 46, Update the
vulnerable dependency version in go.mod by bumping the module
github.com/go-jose/go-jose/v4 from v4.1.1 to v4.1.4 (or later); edit the go.mod
entry for github.com/go-jose/go-jose/v4 and then run `go get
github.com/go-jose/go-jose/v4@v4.1.4` (or the chosen patched version) followed
by `go mod tidy` to ensure go.sum is updated and the project builds cleanly.

github.com/go-logr/logr v1.4.3 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
github.com/go-openapi/errors v0.22.1 // indirect
github.com/go-openapi/jsonpointer v0.21.1 // indirect
Expand Down Expand Up @@ -110,18 +110,18 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.mongodb.org/mongo-driver v1.14.0 // indirect
go.opencensus.io v0.24.0 // indirect
golang.org/x/crypto v0.37.0 // indirect
golang.org/x/crypto v0.39.0 // indirect
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
golang.org/x/net v0.39.0 // indirect
golang.org/x/oauth2 v0.29.0 // indirect
golang.org/x/sync v0.13.0 // indirect
golang.org/x/sys v0.32.0 // indirect
golang.org/x/term v0.31.0 // indirect
golang.org/x/text v0.24.0 // indirect
golang.org/x/net v0.41.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.15.0 // indirect
golang.org/x/sys v0.33.0 // indirect
golang.org/x/term v0.32.0 // indirect
golang.org/x/text v0.26.0 // indirect
golang.org/x/time v0.11.0 // indirect
golang.org/x/tools v0.32.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
golang.org/x/tools v0.33.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/grpc v1.71.0 // indirect
google.golang.org/protobuf v1.36.6 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand All @@ -137,3 +137,5 @@ require (
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
)

replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.75.1-sec.1
Loading