Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upstream go security issue with crypto/elliptic #46391

Closed
cblecker opened this issue May 24, 2017 · 8 comments
Closed

Upstream go security issue with crypto/elliptic #46391

cblecker opened this issue May 24, 2017 · 8 comments
Assignees
@enisoc @mwielgus
Labels
area/security kind/bug Categorizes issue or PR as related to a bug. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release.

Comments

@cblecker
Copy link
Member

cblecker commented May 24, 2017 •
edited
Loading

Yesterday, the golang team released go 1.7.6 and go 1.8.2 to address a security issue involving the crypto/elliptic package. There is currently no known exploit, but as we have dependencies on this package in kubernetes, we should upgrade the versions of go we are using.

Details are here:
golang/go#20040

As we are updating master/1.7 to use go 1.8.3 (#45216 (comment)), I don't think we need any specific action there. However, we should probably update 1.5 and 1.6 to use go 1.7.6.

The kubernetes security team is aware of this issue, and is okay with a public issue on it as details are already public.

/kind bug
/area security
/priority important-soon

cc @timstclair @kubernetes/kubernetes-release-managers @luxas @ixdy @wojtek-t
@k8s-ci-robot k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. area/security priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels May 24, 2017
@cblecker
Copy link
Member Author

cc @kubernetes/kubernetes-release-managers as I misspelled it the first time

This was referenced May 25, 2017
Merged
Merged
@cblecker
Copy link
Member Author

cblecker commented May 25, 2017 •
edited
Loading

I've created:

I'm not sure who the best reviewer is, but I know @luxas and @ixdy have helped with the cross build images previously. If either of you are able to take a look, I'd appreciate it :)

@wojtek-t
Copy link
Member

Bump to 1.8.3 at head is happening in: #46429

@wojtek-t wojtek-t mentioned this issue May 25, 2017
Merged
@cblecker
Copy link
Member Author

The build/cni and cluster/images/etcd on master are currently using go1.7.5. According to @luxas these aren't ready to move to go1.8 quite yet, but we should track them to ensure they get upgraded to either go1.8.3 or go1.7.6.

k8s-github-robot pushed a commit that referenced this issue May 26, 2017
Merge pull request #46405 from cblecker/go-1.7.6-release-1.6
e04b145 
Automatic merge from submit-queue

[release-1.6] Bump golang versions to 1.7.6

**What this PR does / why we need it**:
Addresses #46391 for the release-1.6 branch.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
Tests will not pass until kube-cross image is built and pushed to GCR.

**Release note**:

```release-note
Upgrade golang version to 1.7.6
```
k8s-github-robot pushed a commit that referenced this issue May 26, 2017
Merge pull request #46429 from wojtek-t/bump_go_to_183
59ee250 
Automatic merge from submit-queue (batch tested with PRs 46429, 46308, 46395, 45867, 45492)

Bump Go version to 1.8.3

This PR also removed this patched version of Go 1.8.1 which we used to use to workaround performance problem of Go 1.8.1.

Fix #45216
Ref #46391

@timothysc @bradfitz
@jagosan
Copy link
Contributor

jagosan commented May 26, 2017

/assign @enisoc @mwielgus
Looks like action required in both 1.5 and 1.6.

@cblecker
Copy link
Member Author

To update status here:

  • Fixes have been merged into master and release-1.6
  • 1.5 is still pending approval of @mwielgus
  • There are a couple ancillary images (cni and etcd) that still need to be looked at as candidates for upgrade

k8s-github-robot pushed a commit that referenced this issue May 27, 2017
Merge pull request #46408 from cblecker/go-1.7.6-release-1.5
b067d87 
Automatic merge from submit-queue

[release-1.5] Bump golang versions to 1.7.6

**What this PR does / why we need it**:
Addresses #46391 for the release-1.5 branch.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
Tests will not pass until kube-cross image is built and pushed to GCR.

**Release note**:

```release-note
Upgrade golang version to 1.7.6
```
@luxas
Copy link
Member

luxas commented May 28, 2017

Only thing left is cni and etcd.

  • cni: Won't be released anymore by our scripts
  • etcd: Will probably be released once more, but will probably use 1.8.x.

@cblecker Feel free to send a PR to etcd bump to 1.7.6 in the meantime so we don't miss it in case we'd make a new release of that image.

@cblecker cblecker mentioned this issue May 29, 2017
Merged
k8s-github-robot pushed a commit that referenced this issue May 29, 2017
Merge pull request #46599 from cblecker/cni-etcd-golang
fde99a1 
Automatic merge from submit-queue (batch tested with PRs 45699, 46200, 46335, 46599)

Bump CNI and etcd go base images to 1.7.6

**What this PR does / why we need it**:
Addresses #46391 for CNI and etcd images.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/assign @luxas
@cblecker
Copy link
Member Author

All known instances of go in k/k have been updated to a patched version (go1.7.6 or go1.8.3). 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@enisoc enisoc

@mwielgus mwielgus

Labels
area/security kind/bug Categorizes issue or PR as related to a bug. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@jagosan @cblecker @luxas @enisoc @wojtek-t @mwielgus @k8s-ci-robot