Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCPBUGS-32843: replace square/go-jose to fix cve #400

Closed
wants to merge 1 commit into from
Closed

OCPBUGS-32843: replace square/go-jose to fix cve #400

wants to merge 1 commit into from

Conversation

avinal
Copy link
Member

@avinal avinal commented Jun 25, 2024 •
edited
Loading

Changes

  • gopkg.in/square/go-jose.v2 has been deprecated
  • replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple
    imports issue
  • replaced with security release github.com/go-jose/go-jose v2.6.3
  • fixes CVE-2024-28180

Signed-off-by: Avinal Kumar [email protected]

Release Note

CVE-2024-28180: Upgrade go-jose to mitigate potential denial of service attacks.

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 25, 2024
@openshift-ci-robot
Copy link
Contributor

@avinal: This pull request references Jira Issue OCPBUGS-32843, which is invalid:

  • expected the bug to target either version "4.17." or "openshift-4.17.", but it targets "4.13.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Changes

  • gopkg.in/square/go-jose.v2 has been deprecated
  • replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple
    imports issue
  • replaced with security release github.com/go-jose/go-jose v2.6.3
  • fixes CVE-2024-28180

Signed-off-by: Avinal Kumar [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 25, 2024
@avinal avinal changed the base branch from master to release-4.13 June 25, 2024 10:35
@openshift-ci-robot
Copy link
Contributor

@avinal: This pull request references Jira Issue OCPBUGS-32843, which is invalid:

  • release note text must be set and not match the template OR release note type must be set to "Release Note Not Required"
  • expected dependent Jira Issue OCPBUGS-32844 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Changes

  • gopkg.in/square/go-jose.v2 has been deprecated
  • replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple
    imports issue
  • replaced with security release github.com/go-jose/go-jose v2.6.3
  • fixes CVE-2024-28180

Signed-off-by: Avinal Kumar [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link
Contributor

@avinal: An error was encountered adding this pull request to the external tracker bugs for bug OCPBUGS-32843 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details.

Full error message. failed to get remote links: You do not have the permission to see the specified issue.: request failed. Please analyze the request body for more details. Status code: 401:

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

In response to this:

Changes

  • gopkg.in/square/go-jose.v2 has been deprecated
  • replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple
    imports issue
  • replaced with security release github.com/go-jose/go-jose v2.6.3
  • fixes CVE-2024-28180

Signed-off-by: Avinal Kumar [email protected]

Release Note

CVE-2024-28180: Upgrade go-jose to mitigate potential denial of service attacks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 25, 2024
@avinal
Copy link
Member Author

avinal commented Jun 26, 2024

/retest

adambkaplan
adambkaplan approved these changes Jun 26, 2024
View reviewed changes
Copy link
Contributor

@adambkaplan adambkaplan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 26, 2024
@adambkaplan
Copy link
Contributor

/hold

Need to understand why one of the s2i tests are failing. Perhaps we need openshift/origin#28904 cherry picked to 4.13 too?

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 26, 2024
@adambkaplan
Copy link
Contributor

/jira refresh

@openshift-ci-robot
Copy link
Contributor

@adambkaplan: This pull request references Jira Issue OCPBUGS-32843, which is invalid:

  • release note text must be set and not match the template OR release note type must be set to "Release Note Not Required"
  • expected dependent Jira Issue OCPBUGS-32844 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 8, 2024
@sayan-biswas
Copy link

/retest

@avinal
OCPBUGS-32843: replace square/go-jose to fix cve
5f5feb2 
- gopkg.in/square/go-jose.v2 has been deprecated
- replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple
  imports issue
- replaced with security release github.com/go-jose/go-jose v2.6.3
- fixes CVE-2024-28180

Signed-off-by: Avinal Kumar <[email protected]>
@avinal avinal force-pushed the avinal/ocpbugs-32843 branch from 1006977 to 5f5feb2 Compare October 22, 2024 11:17
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 22, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Oct 22, 2024

New changes are detected. LGTM label has been removed.

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Oct 22, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adambkaplan, avinal

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 22, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Oct 22, 2024

@avinal: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-builds-techpreview 5f5feb2 link false /test e2e-aws-ovn-builds-techpreview
ci/prow/security 5f5feb2 link false /test security
ci/prow/e2e-aws-ovn-builds 5f5feb2 link true /test e2e-aws-ovn-builds

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-bot
Copy link
Contributor

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

@openshift-ci openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 22, 2024
@openshift-ci openshift-ci bot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Nov 22, 2024
@openshift-bot
Copy link
Contributor

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

@openshift-ci openshift-ci bot closed this Dec 22, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Dec 22, 2024

@openshift-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci-robot
Copy link
Contributor

@avinal: This pull request references Jira Issue OCPBUGS-32843. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

In response to this:

Changes

  • gopkg.in/square/go-jose.v2 has been deprecated
  • replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple
    imports issue
  • replaced with security release github.com/go-jose/go-jose v2.6.3
  • fixes CVE-2024-28180

Signed-off-by: Avinal Kumar [email protected]

Release Note

CVE-2024-28180: Upgrade go-jose to mitigate potential denial of service attacks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@adambkaplan adambkaplan adambkaplan approved these changes

@divyansh42 divyansh42 Awaiting requested review from divyansh42

@sayan-biswas sayan-biswas Awaiting requested review from sayan-biswas

Assignees

@adambkaplan adambkaplan

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@avinal @openshift-ci-robot @adambkaplan @openshift-bot @sayan-biswas @openshift-merge-robot