search

Azure / kubelogin

A Kubernetes credential (exec) plugin implementing azure authentication
https://azure.github.io/kubelogin/
MIT License
477 stars 88 forks source link

chore: upgrade go to v1.21.11 to fix CVE-2024-24790 #485

Closed strivedi-px closed 2 months ago

strivedi-px commented 2 months ago

Upgrade Go to v1.21.11 to fix CVE-2024-24790. The CVE was fixed in the following commit: https://go-review.googlesource.com/c/go/+/590315 which was released in the v1.21.11 release of Go.

strivedi-px commented 2 months ago

@bcho when are you planning to create the next release with this fix?

bcho commented 2 months ago

@strivedi-px i will cut a new release tomorrow during PDT business time -- cc @weinong

bcho commented 2 months ago

v0.1.4 published:

go version -m ./kubelogin 
./kubelogin: go1.21.11
        path    github.com/Azure/kubelogin
        mod     github.com/Azure/kubelogin      (devel)
        dep     github.com/Azure/azure-sdk-for-go/sdk/azcore    v1.12.0 h1:1nGuui+4POelzDwI7RG56yfQJHCnKvwfMoU7VsEp+Zg=
        dep     github.com/Azure/azure-sdk-for-go/sdk/azidentity        v1.6.0  h1:U2rTu3Ef+7w9FHKIAXM6ZyqF3UOWJZ12zIm8zECAFfg=
        dep     github.com/Azure/azure-sdk-for-go/sdk/internal  v1.9.0  h1:H+U3Gk9zY56G3u872L82bk4thcsy2Gghb9ExT4Zvm1o=
        dep     github.com/Azure/go-autorest/autorest   v0.11.29        h1:I4+HL/JDvErx2LjyzaVxllw2lRDB5/BT2Bm4g20iqYw=
        dep     github.com/Azure/go-autorest/autorest/adal      v0.9.23 h1:Yepx8CvFxwNKpH6ja7RZ+sKX+DWYNldbLiALMC3BTz8=
        dep     github.com/Azure/go-autorest/autorest/date      v0.3.0  h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
        dep     github.com/Azure/go-autorest/logger     v0.2.1  h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg=
        dep     github.com/Azure/go-autorest/tracing    v0.6.0  h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
        dep     github.com/AzureAD/microsoft-authentication-library-for-go      v1.2.2  h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
        dep     github.com/davecgh/go-spew      v1.1.1  h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
        dep     github.com/emicklei/go-restful/v3       v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
        dep     github.com/evanphx/json-patch   v5.6.0+incompatible     h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
        dep     github.com/go-errors/errors     v1.4.2  h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
        dep     github.com/go-logr/logr v1.4.1  h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
        dep     github.com/go-openapi/jsonpointer       v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
        dep     github.com/go-openapi/jsonreference     v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
        dep     github.com/go-openapi/swag      v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
        dep     github.com/gogo/protobuf        v1.3.2  h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
        dep     github.com/golang-jwt/jwt/v4    v4.5.0  h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
        dep     github.com/golang-jwt/jwt/v5    v5.2.1  h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
        dep     github.com/golang/protobuf      v1.5.4  h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
        dep     github.com/google/btree v1.1.2  h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
        dep     github.com/google/gnostic-models        v0.6.8  h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
        dep     github.com/google/gofuzz        v1.2.0  h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
        dep     github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510      h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
        dep     github.com/google/uuid  v1.6.0  h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
        dep     github.com/gregjones/httpcache  v0.0.0-20190611155906-901d90724c79      h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
        dep     github.com/imdario/mergo        v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
        dep     github.com/josharian/intern     v1.0.0  h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
        dep     github.com/json-iterator/go     v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
        dep     github.com/kylelemons/godebug   v1.1.0  h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
        dep     github.com/liggitt/tabwriter    v0.0.0-20181228230101-89fcab3d43de      h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
        dep     github.com/mailru/easyjson      v0.7.7  h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
        dep     github.com/moby/term    v0.0.0-20221205130635-1aeaba878587      h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
        dep     github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd      h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
        dep     github.com/modern-go/reflect2   v1.0.2  h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
        dep     github.com/monochromegane/go-gitignore  v0.0.0-20200626010858-205db1a8cc00      h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
        dep     github.com/munnerz/goautoneg    v0.0.0-20191010083416-a7dc8b61c822      h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
        dep     github.com/peterbourgon/diskv   v2.0.1+incompatible     h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
        dep     github.com/pkg/browser  v0.0.0-20240102092130-5ac0b6a4141c      h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
        dep     github.com/pkg/errors   v0.9.1  h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
        dep     github.com/spf13/cobra  v1.8.1  h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
        dep     github.com/spf13/pflag  v1.0.5  h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
        dep     github.com/xlab/treeprint       v1.2.0  h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
        dep     go.starlark.net v0.0.0-20230525235612-a134d8f9ddca      h1:VdD38733bfYv5tUZwEIskMM93VanwNIi5bIKnDrJdEY=
        dep     golang.org/x/crypto     v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
        dep     golang.org/x/net        v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
        dep     golang.org/x/oauth2     v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
        dep     golang.org/x/sync       v0.7.0  h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
        dep     golang.org/x/sys        v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
        dep     golang.org/x/term       v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
        dep     golang.org/x/text       v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
        dep     golang.org/x/time       v0.3.0  h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
        dep     google.golang.org/protobuf      v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
        dep     gopkg.in/inf.v0 v0.9.1  h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
        dep     gopkg.in/retry.v1       v1.0.3  h1:a9CArYczAVv6Qs6VGoLMio99GEs7kY9UzSF9+LD+iGs=
        dep     gopkg.in/yaml.v2        v2.4.0  h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
        dep     gopkg.in/yaml.v3        v3.0.1  h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
        dep     k8s.io/api      v0.29.3 h1:2ORfZ7+bGC3YJqGpV0KSDDEVf8hdGQ6A03/50vj8pmw=
        dep     k8s.io/apimachinery     v0.29.3 h1:2tbx+5L7RNvqJjn7RIuIKu9XTsIZ9Z5wX2G22XAa5EU=
        dep     k8s.io/cli-runtime      v0.29.3 h1:r68rephmmytoywkw2MyJ+CxjpasJDQY7AGc3XY2iv1k=
        dep     k8s.io/client-go        v0.29.3 h1:R/zaZbEAxqComZ9FHeQwOh3Y1ZUs7FaHKZdQtIc2WZg=
        dep     k8s.io/klog/v2  v2.130.1        h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
        dep     k8s.io/kube-openapi     v0.0.0-20231010175941-2dd684a91f00      h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
        dep     k8s.io/utils    v0.0.0-20230726121419-3b25d923346b      h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
        dep     sigs.k8s.io/json        v0.0.0-20221116044647-bc3834ca7abd      h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
        dep     sigs.k8s.io/kustomize/api       v0.13.5-0.20230601165947-6ce0bf390ce3   h1:XX3Ajgzov2RKUdc5jW3t5jwY7Bo7dcRm+tFxT+NfgY0=
        dep     sigs.k8s.io/kustomize/kyaml     v0.14.3-0.20230601165947-6ce0bf390ce3   h1:W6cLQc5pnqM7vh3b7HvGNfXrJ/xL6BDMS0v1V/HHg5U=
        dep     sigs.k8s.io/structured-merge-diff/v4    v4.4.1  h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
        dep     sigs.k8s.io/yaml        v1.3.0  h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
        build   -buildmode=exe
        build   -compiler=gc
        build   -ldflags="-X main.gitTag=v0.1.4"
        build   CGO_ENABLED=0
        build   GOARCH=amd64
        build   GOOS=linux
        build   GOAMD64=v1
        build   vcs=git
        build   vcs.revision=aed62b0077827211ca2e6f7422281f34e4221e98
        build   vcs.time=2024-07-05T19:50:24Z
        build   vcs.modified=false
strivedi-px commented 2 months ago

Thanks @bcho! :raised_hands: