search

openshift / builder

The image run by build pods to execute image building+pushing
Apache License 2.0
31 stars 50 forks source link

OCPBUGS-32843: replace square/go-jose to fix cve #400

Open avinal opened 3 months ago

avinal commented 3 months ago

Changes

Signed-off-by: Avinal Kumar avinal@redhat.com

Release Note

CVE-2024-28180: Upgrade go-jose to mitigate potential denial of service attacks.
openshift-ci-robot commented 3 months ago

@avinal: This pull request references Jira Issue OCPBUGS-32843, which is invalid:

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to [this](https://github.com/openshift/builder/pull/400): >## Changes > >- gopkg.in/square/go-jose.v2 has been deprecated >- replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple > imports issue >- replaced with security release github.com/go-jose/go-jose v2.6.3 >- fixes CVE-2024-28180 > >Signed-off-by: Avinal Kumar > Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fbuilder). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci-robot commented 3 months ago

@avinal: This pull request references Jira Issue OCPBUGS-32843, which is invalid:

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to [this](https://github.com/openshift/builder/pull/400): >## Changes > >- gopkg.in/square/go-jose.v2 has been deprecated >- replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple > imports issue >- replaced with security release github.com/go-jose/go-jose v2.6.3 >- fixes CVE-2024-28180 > >Signed-off-by: Avinal Kumar > Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fbuilder). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci-robot commented 3 months ago

@avinal: An error was encountered adding this pull request to the external tracker bugs for bug OCPBUGS-32843 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details.

Full error message. failed to get remote links: You do not have the permission to see the specified issue.: request failed. Please analyze the request body for more details. Status code: 401:

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

In response to [this](https://github.com/openshift/builder/pull/400): >## Changes > >- gopkg.in/square/go-jose.v2 has been deprecated >- replacing with equivalent gopkg.in/go-jose/go-jose.v2 causes multiple > imports issue >- replaced with security release github.com/go-jose/go-jose v2.6.3 >- fixes CVE-2024-28180 > >Signed-off-by: Avinal Kumar > >## Release Note > >```release-note >CVE-2024-28180: Upgrade go-jose to mitigate potential denial of service attacks. >``` > Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fbuilder). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
avinal commented 3 months ago

/retest

openshift-ci[bot] commented 3 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: adambkaplan, avinal Once this PR has been reviewed and has the lgtm label, please assign coreydaley for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/openshift/builder/blob/release-4.13/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
adambkaplan commented 3 months ago

/hold

Need to understand why one of the s2i tests are failing. Perhaps we need https://github.com/openshift/origin/pull/28904 cherry picked to 4.13 too?

adambkaplan commented 3 months ago

/jira refresh

openshift-ci-robot commented 3 months ago

@adambkaplan: This pull request references Jira Issue OCPBUGS-32843, which is invalid:

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to [this](https://github.com/openshift/builder/pull/400#issuecomment-2217539707): >/jira refresh Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fbuilder). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-bot commented 3 days ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

sayan-biswas commented 1 day ago

/retest

openshift-ci[bot] commented 1 day ago

@avinal: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn 10069770ccfdda6ff41ebf810db1f9a9cc47a90d link true /test e2e-aws-ovn
ci/prow/images 10069770ccfdda6ff41ebf810db1f9a9cc47a90d link true /test images
ci/prow/e2e-aws-ovn-cgroupsv2 10069770ccfdda6ff41ebf810db1f9a9cc47a90d link false /test e2e-aws-ovn-cgroupsv2
ci/prow/e2e-aws-ovn-image-ecosystem 10069770ccfdda6ff41ebf810db1f9a9cc47a90d link true /test e2e-aws-ovn-image-ecosystem
ci/prow/unit 10069770ccfdda6ff41ebf810db1f9a9cc47a90d link true /test unit
ci/prow/verify 10069770ccfdda6ff41ebf810db1f9a9cc47a90d link true /test verify
ci/prow/security 10069770ccfdda6ff41ebf810db1f9a9cc47a90d link false /test security

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).