Security: Fix CVE-2024-45337 (golang.org/x/crypto)#2807
Conversation
|
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request upgrades the Go toolchain version to 1.24.0 and updates various dependencies in go.mod and go.sum. The reviewer identified several critical issues with these changes: multiple upgraded dependency versions (including golang.org/x packages, grpc, and protobuf) do not exist in the public Go registry or are future-dated, which will cause build and module resolution failures. Additionally, the Go version upgrade to 1.24.0 in go.mod creates a mismatch with other build configuration files like the Dockerfile and Makefile, which still reference Go 1.21.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| golang.org/x/oauth2 v0.34.0 | ||
| golang.org/x/sync v0.19.0 | ||
| golang.org/x/text v0.32.0 |
There was a problem hiding this comment.
The upgraded versions for these direct dependencies do not exist in the public Go registry:
golang.org/x/oauth2 v0.34.0(latest isv0.26.0)golang.org/x/sync v0.19.0(latest isv0.11.0)golang.org/x/text v0.32.0(latest isv0.22.0)
Please use valid, existing versions to prevent module resolution and build failures.
| golang.org/x/oauth2 v0.34.0 | |
| golang.org/x/sync v0.19.0 | |
| golang.org/x/text v0.32.0 | |
| golang.org/x/oauth2 v0.26.0 | |
| golang.org/x/sync v0.11.0 | |
| golang.org/x/text v0.22.0 |
| golang.org/x/crypto v0.46.0 // indirect | ||
| golang.org/x/net v0.48.0 // indirect | ||
| golang.org/x/sys v0.39.0 // indirect | ||
| golang.org/x/term v0.38.0 // indirect |
There was a problem hiding this comment.
Several of the upgraded dependency versions specified in go.mod do not exist in the public Go registry. For example:
golang.org/x/crypto v0.46.0(latest isv0.33.0)golang.org/x/net v0.48.0(latest isv0.35.0)golang.org/x/sys v0.39.0(latest isv0.30.0)golang.org/x/term v0.38.0(latest isv0.29.0)
Using non-existent versions will cause go build, go test, and go mod tidy to fail with resolution errors. Please downgrade these dependencies to their actual latest stable versions (e.g., v0.33.0 for golang.org/x/crypto to fix the CVE).
| golang.org/x/crypto v0.46.0 // indirect | |
| golang.org/x/net v0.48.0 // indirect | |
| golang.org/x/sys v0.39.0 // indirect | |
| golang.org/x/term v0.38.0 // indirect | |
| golang.org/x/crypto v0.33.0 // indirect | |
| golang.org/x/net v0.35.0 // indirect | |
| golang.org/x/sys v0.30.0 // indirect | |
| golang.org/x/term v0.29.0 // indirect |
References
- Security fixes described in a pull request may be implemented via dependency updates in go.mod instead of direct code changes.
- Security scanner alerts may persist as false positives even after a dependency has been updated. When a bot flags a security issue that is believed to be resolved, confirm the dependency version is correct and investigate if the alert is a false positive before making further code changes.
There was a problem hiding this comment.
| google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect | ||
| google.golang.org/grpc v1.79.3 // indirect | ||
| google.golang.org/protobuf v1.36.10 |
There was a problem hiding this comment.
These dependencies also use non-existent or future-dated versions:
google.golang.org/genproto/googleapis/apiandrpcuse a pseudo-version from December 2025 (v0.0.0-20251202230838-ff82c1b0f217).google.golang.org/grpcusesv1.79.3(latest isv1.70.x).google.golang.org/protobufusesv1.36.10(latest isv1.36.5).
Please run go mod tidy with a real Go toolchain to let Go resolve the correct, existing versions automatically.
| google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect | |
| google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect | |
| google.golang.org/grpc v1.79.3 // indirect | |
| google.golang.org/protobuf v1.36.10 | |
| google.golang.org/genproto/googleapis/api v0.0.0-20240401170217-c3f982113cda // indirect | |
| google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect | |
| google.golang.org/grpc v1.63.0 // indirect | |
| google.golang.org/protobuf v1.33.0 |
| module github.com/openshift-pipelines/pipelines-as-code | ||
|
|
||
| go 1.21 | ||
| go 1.24.0 |
There was a problem hiding this comment.
The Go version in go.mod has been upgraded to 1.24.0, but the Dockerfile (which uses golang:1.21) and the Makefile (which sets GO_TOOLCHAIN ?= go1.21.13) have not been updated. This mismatch will cause build failures or force unexpected toolchain downloads during container builds, especially in offline or restricted environments. Please ensure the Go version is updated consistently across all build configuration files, or revert the go.mod Go version to 1.21 if the project is not ready to upgrade to Go 1.24.
| go 1.24.0 | |
| go 1.21 |
References
- The go directive in go.mod can include specific patch versions when automatically updated by go mod tidy to align with dependencies.
theakshaypant
force-pushed
the
fix/cve-2024-45337-x-crypto-release-v0.27.x-attempt-1
branch
from
7946e09 to
62b14a5
Compare
- Upgrade golang.org/x/crypto from v0.21.0 to v0.31.0 - Fixes authorization bypass via misuse of ServerConfig.PublicKeyCallback - Update vendor directory Resolves: SRVKP-11979 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Akshay Pant <akpant@redhat.com>
Non-constant format strings, unchecked type assertions, unnecessary loop variable copies, and builtin shadowing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Akshay Pant <akpant@redhat.com>
theakshaypant
force-pushed
the
fix/cve-2024-45337-x-crypto-release-v0.27.x-attempt-1
branch
from
62b14a5 to
4ff7298
Compare
1 participant
Summary
This PR fixes CVE-2024-45337 by upgrading `golang.org/x/crypto` from v0.21.0 to v0.31.0.
CVE Details
Changes
golang.org/x/cryptov0.21.0 → v0.31.0golang.org/x/sync,golang.org/x/sys,golang.org/x/term,golang.org/x/textas required by go mod tidyTest Results
Status:⚠️ Pre-existing build failure in pkg/webhook (unrelated to this change)
Build: ✅
go build ./...succeededTests: ❌
go test ./pkg/...— pre-existing failure inpkg/webhook(non-constant format string in call to knative.dev/pkg/webhook.MakeErrorStatus) unrelated to this CVE fixPost-fix scan: ✅
govulncheck— GO-2024-3321 (CVE-2024-45337) no longer detectedBreaking Changes
None. v0.31.0 is backward compatible with v0.21.0 for all APIs used in this repo.
Verification Checklist
golang.org/x/cryptoupgraded to v0.31.0go mod vendorupdatedgo build ./...passesRisk Assessment
Low — patch-level upgrade within the same major version. No API changes. Only security improvements.
🤖 Generated by CVE Fixer Workflow