Skip to content

Commit ef465d2

Browse files
diafourdiafour
authored
chore(module): fix CVEs (#1039)
* chore(module): fix CVEs - Update golang.org/x/crypto to v0.38.0, mitigate CVE-2024-45337,CVE-2025-22869 - Update golang.org/x/net to v0.40.0, mitigate CVE-2025-22870, CVE-2025-22872 - Update github.com/go-jose/go-jose/v3@v3.0.4, mitigate CVE-2025-27144 - Update Go 1.23, mitigate CVE-2024-45336, CVE-2024-45341, CVE-2025-22866, CVE-2025-22871 - Use Go 1.23 for virtualization-artifact, dvcr-importer, dvcr-updater, kube-api-rewriter, pre-delete-hook, CDI images, for helper C programs and dvcr. - Cleanup virtualization_images.yaml, only ALT_P11 remains. --------- Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
1 parent c0ad2c8 commit ef465d2

30 files changed

Lines changed: 450 additions & 736 deletions

File tree

‎.github/workflows/dev_module_build.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ env:
2525
GOLANGCI_LINT_VERSION: "1.64.8"
2626
SOURCE_REPO: "${{secrets.SOURCE_REPO}}"
2727
SOURCE_REPO_GIT: "${{secrets.SOURCE_REPO_GIT}}"
28+
TRIVY_DISABLE_VEX_NOTICE: "true"
2829

2930
on:
3031
workflow_dispatch:

‎base-images/virtualization_images.yml‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
11
# REGISTRY_PATH is a special key which is concatenated with other base images
22
REGISTRY_PATH: "docker.io/"
33

4-
# Virtualization images
5-
BASE_DEBIAN_BOOKWORM_SLIM: "debian:bookworm-slim@sha256:e9ac68ffde903b241342267a51cd74c5417414af652cb2e380c6ddcf522589bc"
6-
BASE_CONTAINER_REGISTRY: "registry:2.8.3@sha256:ac0192b549007e22998eb74e8d8488dcfe70f1489520c3b144a6047ac5efbe90"
7-
BASE_GOLANG_22_BOOKWORM: "golang:1.22.8-bookworm@sha256:9e7db50b9858e9cd804043200f1e6acd5a11111151ce886951c9fe3523002cea"
8-
BASE_GOLANG_23_BOOKWORM: "golang:1.23.6-bookworm@sha256:441f59f8a2104b99320e1f5aaf59a81baabbc36c81f4e792d5715ef09dd29355"
9-
10-
BASE_ALT_P10: "alt:p10@sha256:4fab03b8d23eb16147397b0bc41a5025ba59f4e834f7fb4b933ac5206431d740"
114
# Digest for image created at 2024-09-20.
125
BASE_ALT_P11: "alt:p11@sha256:39f03d3bca1a92dc36835c28c2ba2f22ec15257e950b3930e0a3f034466e8dfb"
13-
BASE_ALPINE: "alpine:3.17.10@sha256:3451da08fc6ef554a100da3e2df5ac6d598c82f2a774d5f6ed465c3d80cd163a"

‎images/base-alt-p10/werf.inc.yaml‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎images/bounder/werf.inc.yaml‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ imageSpec:
1212
---
1313
image: {{ $.ImageName }}-cbuilder
1414
final: false
15-
fromImage: BASE_DEBIAN_BOOKWORM_SLIM
15+
fromImage: builder/golang-bookworm-1.23
1616
git:
1717
- add: /images/{{ $.ImageName }}/static_binaries
1818
to: /
@@ -22,12 +22,10 @@ git:
2222
shell:
2323
beforeInstall:
2424
{{- include "debian packages proxy" . | nindent 2 }}
25-
- |
26-
apt-get install --yes \
27-
gcc musl-dev musl-tools
25+
- apt-get install --yes musl-dev musl-tools
2826
{{- include "debian packages clean" . | nindent 2 }}
2927
install:
30-
- |
28+
- |
3129
echo "Building simple app that prints hello cdi"
3230
mkdir -p /bins
3331
musl-gcc -static -Os -o /bins/hello_bounder hello_bounder.c

‎images/cdi-artifact/werf.inc.yaml‎

Lines changed: 29 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
22
{{- $version := "1.60.3" }}
3-
{{- $goVersion := "1.22.7" }}
43
{{- $gitRepoUrl := "kubevirt/containerized-data-importer.git" }}
54

5+
---
66
image: {{ $.ImageName }}
77
final: false
8-
fromImage: BASE_GOLANG_22_BOOKWORM
8+
fromImage: builder/golang-bookworm-1.23
99
mount:
1010
- fromPath: ~/go-pkg-cache
1111
to: /go/pkg
@@ -32,35 +32,46 @@ shell:
3232
install:
3333
- |
3434
mkdir -p ~/.ssh && echo "StrictHostKeyChecking accept-new" > ~/.ssh/config
35-
36-
git clone --depth 1 $(cat /run/secrets/SOURCE_REPO)/{{ $gitRepoUrl }} --branch v{{ $version }} /containerized-data-importer
37-
38-
cd /containerized-data-importer
3935
40-
echo Download Go modules.
41-
go get golang.org/x/crypto@v0.31.0
42-
go mod download
43-
44-
go mod tidy
45-
go mod vendor
36+
echo "Git clone CDI repository..."
37+
git config --global --add advice.detachedHead false
38+
git clone --depth 1 --branch v{{ $version }} $(cat /run/secrets/SOURCE_REPO)/{{ $gitRepoUrl }} /containerized-data-importer
4639
4740
- |
41+
cd /containerized-data-importer
4842
for p in /patches/*.patch ; do
4943
echo -n "Apply ${p} ... "
5044
git apply --ignore-space-change --ignore-whitespace ${p} && echo OK || (echo FAIL ; exit 1)
5145
done
5246
47+
- |
48+
echo Download Go modules.
49+
go mod download
50+
51+
echo Update modules to mitigate CVEs...
52+
53+
# CVE-2024-45337,CVE-2025-22869
54+
go get golang.org/x/crypto@v0.38.0
55+
# CVE-2025-22870, CVE-2025-22872
56+
go get golang.org/x/net@v0.40.0
57+
58+
# CVE-2025-27144
59+
go get github.com/go-jose/go-jose/v3@v3.0.4
60+
61+
go mod tidy
62+
go mod vendor
63+
5364
setup:
5465
- mkdir /cdi-binaries
5566
- cd /containerized-data-importer
5667

57-
- export GO111MODULE=on
5868
- export GOOS=linux
59-
- export CGO_ENABLED=0
6069
- export GOARCH=amd64
70+
- export CGO_ENABLED=0
71+
- export X_FLAGS="-X kubevirt.io/containerized-data-importer/pkg/version.gitVersion=v{{ $version }}-patched"
6172

6273
- echo ============== Build cdi-apiserver ===========
63-
- go build -ldflags="-s -w" -o /cdi-binaries/cdi-apiserver ./cmd/cdi-apiserver
74+
- go build -ldflags="-s -w $X_FLAGS" -o /cdi-binaries/cdi-apiserver ./cmd/cdi-apiserver
6475

6576
- echo ============== Build cdi-cloner ===========
6677
- go build -ldflags="-s -w" -o /cdi-binaries/cdi-cloner ./cmd/cdi-cloner
@@ -83,15 +94,13 @@ shell:
8394
- echo ============== Build cdi-operator ===========
8495
- go build -ldflags="-s -w" -o /cdi-binaries/cdi-operator ./cmd/cdi-operator
8596

86-
- strip /cdi-binaries/*
87-
- chmod +x /cdi-binaries/*
8897
- chown -R 64535:64535 /cdi-binaries/*
8998
- ls -la /cdi-binaries
9099

91100
---
92101
image: {{ $.ImageName }}-cbuilder
93102
final: false
94-
fromImage: BASE_DEBIAN_BOOKWORM_SLIM
103+
fromImage: builder/golang-bookworm-1.23
95104
git:
96105
- add: /images/{{ $.ImageName }}/static_binaries
97106
to: /
@@ -100,9 +109,9 @@ git:
100109
- '*.c'
101110
shell:
102111
install:
103-
{{- include "debian packages proxy" . | nindent 2 }}
112+
{{- include "debian packages proxy" . | nindent 2 }}
104113
- |
105-
apt-get install --yes gcc musl-dev musl-tools
114+
apt-get install --yes musl-dev musl-tools
106115
{{- include "debian packages clean" . | nindent 2 }}
107116
- |
108117
echo "Building simple app that prints hello cdi"

‎images/cdi-cloner/werf.inc.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ shell:
5151
---
5252
image: {{ $.ImageName }}-gobuild
5353
final: false
54-
fromImage: BASE_GOLANG_22_BOOKWORM
54+
fromImage: builder/golang-bookworm-1.23
5555
git:
5656
- add: /images/{{ $.ImageName }}/cloner-startup
5757
to: /app
@@ -60,7 +60,7 @@ git:
6060
- '**/*'
6161
shell:
6262
install:
63-
- |
64-
mkdir -p /cdi-binaries
65-
cd /app
66-
go build -ldflags="-s -w" -o /cdi-binaries/cloner-startup ./cmd/cloner-startup
63+
- |
64+
mkdir -p /cdi-binaries
65+
cd /app
66+
go build -ldflags="-s -w" -o /cdi-binaries/cloner-startup ./cmd/cloner-startup

‎images/dvcr-artifact/go.mod‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,30 @@
11
module github.com/deckhouse/virtualization-controller/dvcr-importers
22

3-
go 1.22.7
3+
go 1.23.0
4+
5+
toolchain go1.23.9
46

57
require (
68
github.com/containers/image/v5 v5.32.0
9+
github.com/deckhouse/virtualization/api v0.0.0-20241220154636-ce1f73499998
710
github.com/distribution/reference v0.6.0
811
github.com/docker/cli v27.1.1+incompatible
912
github.com/golang/snappy v0.0.4
1013
github.com/google/go-containerregistry v0.20.0
1114
github.com/google/uuid v1.6.0
1215
github.com/hashicorp/go-multierror v1.1.1
16+
github.com/manifoldco/promptui v0.9.0
1317
github.com/openshift/library-go v0.0.0-20240621150525-4bb4238aef81
1418
github.com/pkg/errors v0.9.1
1519
github.com/prometheus/client_golang v1.19.0
1620
github.com/prometheus/client_model v0.6.0
17-
golang.org/x/net v0.26.0 // indirect
18-
golang.org/x/sync v0.10.0
21+
github.com/spf13/cobra v1.8.1
22+
golang.org/x/sync v0.14.0
1923
k8s.io/klog/v2 v2.120.1
2024
kubevirt.io/containerized-data-importer v0.0.0-00010101000000-000000000000
2125
kubevirt.io/containerized-data-importer-api v1.60.3
2226
)
2327

24-
require (
25-
github.com/deckhouse/virtualization/api v0.0.0-20241220154636-ce1f73499998
26-
github.com/manifoldco/promptui v0.9.0
27-
github.com/spf13/cobra v1.8.1
28-
)
29-
3028
require (
3129
cloud.google.com/go v0.112.0 // indirect
3230
cloud.google.com/go/compute/metadata v0.3.0 // indirect
@@ -108,12 +106,13 @@ require (
108106
go.opentelemetry.io/otel v1.24.0 // indirect
109107
go.opentelemetry.io/otel/metric v1.24.0 // indirect
110108
go.opentelemetry.io/otel/trace v1.24.0 // indirect
111-
golang.org/x/crypto v0.31.0 // indirect
109+
golang.org/x/crypto v0.38.0 // indirect
112110
golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 // indirect
111+
golang.org/x/net v0.26.0 // indirect
113112
golang.org/x/oauth2 v0.21.0 // indirect
114-
golang.org/x/sys v0.28.0 // indirect
115-
golang.org/x/term v0.27.0 // indirect
116-
golang.org/x/text v0.21.0 // indirect
113+
golang.org/x/sys v0.33.0 // indirect
114+
golang.org/x/term v0.32.0 // indirect
115+
golang.org/x/text v0.25.0 // indirect
117116
golang.org/x/time v0.5.0 // indirect
118117
google.golang.org/api v0.155.0 // indirect
119118
google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
@@ -143,11 +142,15 @@ require (
143142
replace (
144143
github.com/aws/aws-sdk-go => github.com/aws/aws-sdk-go v1.34.0
145144
github.com/chzyer/logex => github.com/chzyer/logex v1.2.1
145+
github.com/go-jose/go-jose/v3 => github.com/go-jose/go-jose/v3 v3.0.4
146146
github.com/openshift/api => github.com/openshift/api v0.0.0-20230406152840-ce21e3fe5da2
147147
github.com/openshift/client-go => github.com/openshift/client-go v0.0.0-20230324103026-3f1513df25e0
148148
github.com/openshift/library-go => github.com/mhenriks/library-go v0.0.0-20230310153733-63d38b55bd5a
149149
github.com/operator-framework/operator-lifecycle-manager => github.com/operator-framework/operator-lifecycle-manager v0.0.0-20190128024246-5eb7ae5bdb7a
150150

151+
golang.org/x/crypto => golang.org/x/crypto v0.38.0 // CVE-2024-45337,CVE-2025-22869
152+
golang.org/x/net => golang.org/x/net v0.40.0 // CVE-2025-22870, CVE-2025-22872
153+
151154
k8s.io/api => k8s.io/api v0.30.2
152155
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.30.2
153156
k8s.io/apimachinery => k8s.io/apimachinery v0.30.2

0 commit comments

Comments
 (0)