Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Backport release-1.27] Fixes for CVE-2023-44487 #3577

Merged
merged 34 commits into from
Oct 24, 2023
Merged

[Backport release-1.27] Fixes for CVE-2023-44487 #3577

merged 34 commits into from
Oct 24, 2023

Conversation

twz123
Copy link
Member

@twz123 twz123 commented Oct 11, 2023 •
edited
Loading

Fixes CVE-2023-44487. Golang has probably its own CVE number assigned for their patches (they refer to it as CVE-2023-39325).

Backport to release-1.27:

See:

@twz123 twz123 added security fix dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Oct 11, 2023
@twz123 twz123 force-pushed the backport-3576-to-release-1.27 branch from 4f04659 to fa2b063 Compare October 12, 2023 11:01
@twz123 twz123 changed the title [Backport release-1.27] Bump google.golang.org/grpc from 1.54.0 to 1.58.3 [Backport release-1.27] Fixes for CVE-2023-44487 Oct 12, 2023
dependabot bot added 25 commits October 12, 2023 15:44
@dependabot @twz123
Bump google.golang.org/grpc from 1.54.0 to 1.55.0
01b5198 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.54.0 to 1.55.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.54.0...v1.55.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 1bbd387)
@dependabot @twz123
Bump golang.org/x/sys from 0.7.0 to 0.8.0
01f962e 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.7.0 to 0.8.0.
- [Commits](golang/sys@v0.7.0...v0.8.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 993e5d2)
@dependabot @twz123
Bump golang.org/x/tools from 0.8.0 to 0.9.0
5b830e9 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.8.0 to 0.9.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.8.0...v0.9.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit a93cc8c)
@dependabot @twz123
Bump golang.org/x/crypto from 0.8.0 to 0.9.0
58c9166 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.8.0 to 0.9.0.
- [Commits](golang/crypto@v0.8.0...v0.9.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 3a7fbee)
@dependabot @twz123
Bump golang.org/x/tools from 0.9.0 to 0.9.1
3892d9a 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.9.0 to 0.9.1.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.9.0...v0.9.1)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 591460e)
@dependabot @twz123
Bump golang.org/x/tools from 0.9.1 to 0.9.3
154dccc 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.9.1 to 0.9.3.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.9.1...v0.9.3)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit a79def6)
@dependabot @twz123
Bump golang.org/x/sys from 0.8.0 to 0.9.0
fbcbc14 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.8.0 to 0.9.0.
- [Commits](golang/sys@v0.8.0...v0.9.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 451c99c)
@dependabot @twz123
Bump golang.org/x/crypto from 0.9.0 to 0.10.0
c08c157 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.9.0 to 0.10.0.
- [Commits](golang/crypto@v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 6eec654)
@dependabot @twz123
Bump golang.org/x/mod from 0.10.0 to 0.11.0
f62348d 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.10.0 to 0.11.0.
- [Commits](golang/mod@v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit f9a0dcf)
@dependabot @twz123
Bump golang.org/x/sync from 0.2.0 to 0.3.0
6f039f9 
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.2.0 to 0.3.0.
- [Commits](golang/sync@v0.2.0...v0.3.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 670dae4)
@dependabot @twz123
Bump golang.org/x/tools from 0.9.3 to 0.10.0
e8c3d51 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.9.3 to 0.10.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.9.3...v0.10.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 4034c61)
@dependabot @twz123
Bump google.golang.org/grpc from 1.55.0 to 1.56.1
91cf6bc 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.55.0 to 1.56.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.55.0...v1.56.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit c6cd5a6)
@dependabot @twz123
Bump golang.org/x/mod from 0.11.0 to 0.12.0
b9c3ed2 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.11.0 to 0.12.0.
- [Commits](golang/mod@v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 6d31572)
@dependabot @twz123
Bump golang.org/x/sys from 0.9.0 to 0.10.0
87e4e17 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.9.0 to 0.10.0.
- [Commits](golang/sys@v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 36a6e8f)
@dependabot @twz123
Bump golang.org/x/crypto from 0.10.0 to 0.11.0
a20fa02 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.10.0 to 0.11.0.
- [Commits](golang/crypto@v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 9121f1a)
@dependabot @twz123
Bump google.golang.org/grpc from 1.56.1 to 1.56.2
fe0dc4b 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.1 to 1.56.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.56.1...v1.56.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit f6dd695)
@dependabot @twz123
Bump golang.org/x/tools from 0.10.0 to 0.11.0
4751f4d 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.10.0 to 0.11.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit c9e9365)
@dependabot @twz123
Bump google.golang.org/grpc from 1.56.2 to 1.57.0
8d7551f 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.2 to 1.57.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.56.2...v1.57.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit c053307)
@dependabot @twz123
Bump golang.org/x/tools from 0.11.0 to 0.11.1
ef92726 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.11.0 to 0.11.1.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.11.0...v0.11.1)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 5abdb39)
@dependabot @twz123
Bump golang.org/x/crypto from 0.11.0 to 0.12.0
40bb0cf 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.11.0 to 0.12.0.
- [Commits](golang/crypto@v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit cd74894)
@dependabot @twz123
Bump golang.org/x/tools from 0.11.1 to 0.12.0
f9999eb 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.11.1 to 0.12.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.11.1...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 67f6afe)
@dependabot @twz123
Bump golang.org/x/crypto from 0.12.0 to 0.13.0
a640d2d 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.12.0 to 0.13.0.
- [Commits](golang/crypto@v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 951c31c)
@dependabot @twz123
Bump google.golang.org/grpc from 1.57.0 to 1.58.0
c04f967 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.57.0 to 1.58.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.57.0...v1.58.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 56eefe1)
@dependabot @twz123
Bump golang.org/x/tools from 0.12.0 to 0.13.0
5abc751 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.12.0 to 0.13.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit d06e99a)
@dependabot @twz123
Bump google.golang.org/grpc from 1.58.0 to 1.58.1
689aebc 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.0 to 1.58.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.58.0...v1.58.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 3d8aff2)
dependabot bot and others added 9 commits October 12, 2023 16:18
@dependabot @twz123
Bump google.golang.org/grpc from 1.58.1 to 1.58.2
a8e17c5 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.1 to 1.58.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.58.1...v1.58.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 91ffada)
@dependabot @twz123
Bump golang.org/x/sys from 0.12.0 to 0.13.0
657567f 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.12.0 to 0.13.0.
- [Commits](golang/sys@v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 4eeb4f5)
(cherry picked from commit 28a9b10)
@dependabot @twz123
Bump golang.org/x/sync from 0.3.0 to 0.4.0
b7f514e 
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.3.0 to 0.4.0.
- [Commits](golang/sync@v0.3.0...v0.4.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 2512292)
(cherry picked from commit 41075ed)
@dependabot @twz123
Bump golang.org/x/mod from 0.12.0 to 0.13.0
250695a 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.12.0 to 0.13.0.
- [Commits](golang/mod@v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit c2172d5)
(cherry picked from commit f1dd707)
@dependabot @twz123
Bump golang.org/x/crypto from 0.13.0 to 0.14.0
ed524ba 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.13.0 to 0.14.0.
- [Commits](golang/crypto@v0.13.0...v0.14.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 8985fcf)
(cherry picked from commit b03d62b)
@dependabot @twz123
Bump golang.org/x/tools from 0.13.0 to 0.14.0
f4e0b04 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.13.0 to 0.14.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.13.0...v0.14.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 6f87023)
(cherry picked from commit f23349f)
@dependabot @twz123
Bump google.golang.org/grpc from 1.58.2 to 1.58.3
6799bd7 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.2 to 1.58.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.58.2...v1.58.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 054ef1a)
(cherry picked from commit 64d0bf2)
@dependabot @twz123
Bump golang.org/x/net from 0.16.0 to 0.17.0
2dfe892 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.16.0 to 0.17.0.
- [Commits](golang/net@v0.16.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit c6209a8)
(cherry picked from commit e1032fd)
@twz123
Bump golang.org/x/net from 0.8.0 to 0.17.0 in /hack/tool
2252f27 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

See: 9661a8d ("Bump golang.org/x/net from 0.13.0 to 0.17.0 in /hack/tool")
Signed-off-by: Tom Wieczorek <[email protected]>
@twz123 twz123 force-pushed the backport-3576-to-release-1.27 branch from fa2b063 to 2252f27 Compare October 12, 2023 14:20
@twz123 twz123 added the backport/release-1.26 PR that needs to be backported/cherrypicked to release-1.26 branch label Oct 12, 2023
@twz123 twz123 mentioned this pull request Oct 23, 2023
Merged
16 tasks
@twz123 twz123 marked this pull request as ready for review October 23, 2023 14:24
@twz123 twz123 requested a review from a team as a code owner October 23, 2023 14:25
@twz123 twz123 requested review from ncopa and makhov October 23, 2023 14:25
@ncopa ncopa merged commit b31f279 into k0sproject:release-1.27 Oct 24, 2023
69 checks passed
@k0s-bot
Copy link

k0s-bot commented Oct 24, 2023

Backport failed for release-1.26, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally.

git fetch origin release-1.26
git worktree add -d .worktree/backport-3577-to-release-1.26 origin/release-1.26
cd .worktree/backport-3577-to-release-1.26
git checkout -b backport-3577-to-release-1.26
ancref=$(git merge-base 621e6c09f2ceb53abb47b38f2226d167736fe504 2252f27e232acd3b10e7d8c66f149ac4045fdaf4)
git cherry-pick -x $ancref..2252f27e232acd3b10e7d8c66f149ac4045fdaf4

@twz123 twz123 mentioned this pull request Oct 24, 2023
Merged
@twz123 twz123 deleted the backport-3576-to-release-1.27 branch October 24, 2023 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ncopa ncopa ncopa approved these changes

@makhov makhov Awaiting requested review from makhov makhov is a code owner automatically assigned from k0sproject/k0s-maintainers

Assignees
No one assigned
Labels
backport/release-1.26 PR that needs to be backported/cherrypicked to release-1.26 branch dependencies Pull requests that update a dependency file go Pull requests that update Go code security fix
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@twz123 @k0s-bot @ncopa