Fixed: vulnerabilities scanned with govulncheck #2841

aimuz · 2022-12-02T08:28:27Z

What type of PR is this?

Uncomment only one /kind <> line, press enter to put that in a new line, and remove leading whitespace from that line:

/kind breaking
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind hotfix

/kind bug

What this PR does / Why we need it:

govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Scanning for dependencies with known vulnerabilities...
No vulnerabilities found.

=== Informational ===

The vulnerabilities below are in packages that you import, but your code
doesn't appear to call any vulnerable functions. You may not need to take any
action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability #1: GO-2022-0969
  HTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service.
  Found in: golang.org/x/net/[email protected]
  Fixed in: golang.org/x/net/[email protected]
  More info: https://pkg.go.dev/vuln/GO-2022-0969

Vulnerability #2: GO-2022-0493
  When called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible.
  Found in: golang.org/x/sys/[email protected]
  Fixed in: golang.org/x/sys/[email protected]
  More info: https://pkg.go.dev/vuln/GO-2022-0493

Vulnerability #3: GO-2022-0322
  The Prometheus client_golang HTTP server is vulnerable to a denial of service attack when handling requests with non-standard HTTP methods.

  In order to be affected, an instrumented software must use any of the promhttp.InstrumentHandler* middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass a metric with a "method" label name to a middleware; and not have any firewall/LB/proxy that filters away requests with unknown "method".
  Found in: github.com/prometheus/client_golang/prometheus/[email protected]
  Fixed in: github.com/prometheus/client_golang/prometheus/[email protected]
  More info: https://pkg.go.dev/vuln/GO-2022-0322

Which issue(s) this PR fixes:

Closes #

Special notes for your reviewer:

agones-bot · 2022-12-02T08:34:21Z

Build Failed 😱

Build Id: ee6176cd-0ef3-445d-bb66-b209019d404f

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

agones-bot · 2022-12-02T09:08:23Z

Build Succeeded 👏

Build Id: 48224202-2aa2-405b-8098-a3ca112ea5ab

The following development artifacts have been built, and will exist for the next 30 days:

image: us-docker.pkg.dev/agones-images/ci/agones-controller:1.28.0-0f1608c-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-sdk:1.28.0-0f1608c-linux-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-ping:1.28.0-0f1608c-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-allocator:1.28.0-0f1608c-amd64
Linux C++ SDK (build): agonessdk-1.28.0-0f1608c-amd64-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.28.0-0f1608c-amd64.zip

A preview of the website (the last 30 builds are retained):

https://0f1608c-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/2841/head:pr_2841 && git checkout pr_2841
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.tag=1.28.0-0f1608c-amd64

zmerlynn · 2022-12-02T14:15:14Z

Should we add govulncheck to CI? (Though I guess that would make it non-hermetic.)

zmerlynn · 2022-12-02T14:16:53Z

This LGTM, and I would be inclined to take it even in feature freeze, but (a) nothing in that list seems uber critical, and (b) the large number of vendored code changes makes me inclined to let this bake. So, approved, but after freeze.

markmandel · 2022-12-02T15:21:59Z

Should we add govulncheck to CI? (Though I guess that would make it non-hermetic.)

I looked for a tool like this ages ago - I'd love to see it in CI! But let's file a big and take through it 👍🏻

roberthbailey · 2022-12-03T06:46:50Z

FYI, this is likely to have conflicts with #2786 since they are both touching the protobuf dependency so we should figure out which one to merge first after the release freeze is lifted.

aimuz · 2022-12-03T07:25:53Z

@roberthbailey I don't care which one is merged first, if there is a conflict, I will solve it. 😀

markmandel · 2022-12-08T21:38:21Z

That's a lot of conflicts 😨

But yeah - if we can get those cleaned up, this should be good to go 👍🏻

Signed-off-by: aimuz <[email protected]>

aimuz · 2022-12-09T02:01:32Z

Yes, I resolved the conflict

markmandel · 2022-12-09T02:06:03Z

Thank you!

agones-bot · 2022-12-09T02:41:48Z

Build Succeeded 👏

Build Id: 9446c066-9608-452d-a0d2-3273900f6587

The following development artifacts have been built, and will exist for the next 30 days:

image: us-docker.pkg.dev/agones-images/ci/agones-controller:1.29.0-480e01d-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-sdk:1.29.0-480e01d-linux-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-ping:1.29.0-480e01d-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-allocator:1.29.0-480e01d-amd64
Linux C++ SDK (build): agonessdk-1.29.0-480e01d-amd64-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.29.0-480e01d-amd64.zip

A preview of the website (the last 30 builds are retained):

https://480e01d-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/2841/head:pr_2841 && git checkout pr_2841
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.tag=1.29.0-480e01d-amd64

google-oss-prow · 2022-12-09T05:25:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aimuz, roberthbailey

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [roberthbailey]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

agones-bot · 2022-12-09T06:02:57Z

Build Succeeded 👏

Build Id: 048f2f57-bdd7-4273-aa06-67a9473fe9e0

The following development artifacts have been built, and will exist for the next 30 days:

image: us-docker.pkg.dev/agones-images/ci/agones-controller:1.29.0-4f10676-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-sdk:1.29.0-4f10676-linux-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-ping:1.29.0-4f10676-amd64
image: us-docker.pkg.dev/agones-images/ci/agones-allocator:1.29.0-4f10676-amd64
Linux C++ SDK (build): agonessdk-1.29.0-4f10676-amd64-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.29.0-4f10676-amd64.zip

A preview of the website (the last 30 builds are retained):

https://4f10676-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/googleforgames/agones.git pull/2841/head:pr_2841 && git checkout pr_2841
helm install agones ./install/helm/agones --namespace agones-system --set agones.image.tag=1.29.0-4f10676-amd64

Signed-off-by: aimuz <[email protected]> Co-authored-by: Robert Bailey <[email protected]>

google-oss-prow bot requested review from dzlier-gcp and pooneh-m December 2, 2022 08:28

google-oss-prow bot added the size/XXL label Dec 2, 2022

aimuz force-pushed the fix-with-govulncheck branch from e29dfbb to 0f1608c Compare December 2, 2022 08:41

zmerlynn self-assigned this Dec 2, 2022

zmerlynn added the feature-freeze-do-not-merge Only eligible to be merged once we are out of feature freeze (next full release) label Dec 2, 2022

markmandel mentioned this pull request Dec 2, 2022

Should we add govulncheck to CI? #2842

Closed

mangalpalli removed the feature-freeze-do-not-merge Only eligible to be merged once we are out of feature freeze (next full release) label Dec 7, 2022

Fixed: vulnerabilities scanned with govulncheck

480e01d

Signed-off-by: aimuz <[email protected]>

aimuz force-pushed the fix-with-govulncheck branch from 0f1608c to 480e01d Compare December 9, 2022 01:59

Merge branch 'main' into fix-with-govulncheck

4f10676

roberthbailey approved these changes Dec 9, 2022

View reviewed changes

google-oss-prow bot assigned roberthbailey Dec 9, 2022

google-oss-prow bot added the lgtm label Dec 9, 2022

google-oss-prow bot added the approved label Dec 9, 2022

roberthbailey enabled auto-merge (squash) December 9, 2022 05:26

roberthbailey merged commit 3dec30e into googleforgames:main Dec 9, 2022

aimuz deleted the fix-with-govulncheck branch December 9, 2022 06:10

chiayi pushed a commit to chiayi/agones that referenced this pull request Dec 13, 2022

Fixed: vulnerabilities scanned with govulncheck (googleforgames#2841)

38fa171

Signed-off-by: aimuz <[email protected]> Co-authored-by: Robert Bailey <[email protected]>

Kalaiselvi84 added this to the 1.29.0 milestone Jan 17, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixed: vulnerabilities scanned with govulncheck #2841

Fixed: vulnerabilities scanned with govulncheck #2841

aimuz commented Dec 2, 2022

agones-bot commented Dec 2, 2022

agones-bot commented Dec 2, 2022

zmerlynn commented Dec 2, 2022

zmerlynn commented Dec 2, 2022

markmandel commented Dec 2, 2022

roberthbailey commented Dec 3, 2022

aimuz commented Dec 3, 2022

markmandel commented Dec 8, 2022

aimuz commented Dec 9, 2022

markmandel commented Dec 9, 2022

agones-bot commented Dec 9, 2022

google-oss-prow bot commented Dec 9, 2022

agones-bot commented Dec 9, 2022

Fixed: vulnerabilities scanned with govulncheck #2841

Fixed: vulnerabilities scanned with govulncheck #2841

Conversation

aimuz commented Dec 2, 2022

agones-bot commented Dec 2, 2022

agones-bot commented Dec 2, 2022

zmerlynn commented Dec 2, 2022

zmerlynn commented Dec 2, 2022

markmandel commented Dec 2, 2022

roberthbailey commented Dec 3, 2022

aimuz commented Dec 3, 2022

markmandel commented Dec 8, 2022

aimuz commented Dec 9, 2022

markmandel commented Dec 9, 2022

agones-bot commented Dec 9, 2022

google-oss-prow bot commented Dec 9, 2022

agones-bot commented Dec 9, 2022