kubernetes-sigs / aws-ebs-csi-driver

CSI driver for Amazon EBS https://aws.amazon.com/ebs/
Apache License 2.0
974 stars 787 forks source link

Address GO-2024-2824 #2038

Closed torredil closed 4 months ago

torredil commented 4 months ago

Is this a bug fix or adding new feature?

CVE Fix

What is this PR about? / Why do we need it?

Vulnerability #1: GO-2024-2824
    Malformed DNS message can cause infinite loop in net
  More info: https://pkg.go.dev/vuln/GO-2024-2824
  Standard library
    Found in: net@go1.22.2
    Fixed in: net@go1.22.3
    Example traces found:
Error:       #1: tests/e2e/testsuites/testsuites.go:752:78: testsuites.podLogs calls rest.Request.Do, which eventually calls net.Dialer.DialContext
Error:       #2: pkg/driver/driver.go:99:29: driver.Driver.Run calls net.Listen
Error:       #3: pkg/cloud/cloud.go:331:38: cloud.newEC2Cloud calls config.LoadDefaultConfig, which eventually calls net.LookupHost
Error:       #4: tests/e2e/format_options.go:33:17: e2e.init calls ginkgo.Describe, which eventually calls net.Resolver.LookupHost
Error:       #5: tests/e2e/format_options.go:33:17: e2e.init calls ginkgo.Describe, which eventually calls net.Resolver.LookupSRV
Error:       #6: tests/e2e/format_options.go:33:17: e2e.init calls ginkgo.Describe, which eventually calls net.Resolver.LookupTXT

What testing is done?

make verify && make test
github-actions[bot] commented 4 months ago

Code Coverage Diff

This PR does not change the code coverage

ConnorJC3 commented 4 months ago

/lgtm /approve

k8s-ci-robot commented 4 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ConnorJC3

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/OWNERS)~~ [ConnorJC3] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
AndrewSirenko commented 4 months ago

/hold

AndrewSirenko commented 4 months ago

/unhold