fix(deps): updated vulnerable dependencies #1567

rootxrishabh · 2023-12-29T21:29:01Z

Purpose of PR?:
This PR updates all the vulnerable dependencies alerted by the OSSF scorecard.
Fixes #
#1532
Does this PR introduce a breaking change?
No
If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

Bug fix. Fixes #
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update
PR Title follows the convention of <type>(<scope>): <subject>
Commit has unit tests
Commit has integration tests

Signed-off-by: rootxrishabh <[email protected]>

DelusionalOptimist · 2024-01-10T13:10:47Z

@rootxrishabh can you try by removing these k8s.io replace directives across KubeArmor's and other go.mod files? I think it should fix the current build failure. 🤔

KubeArmor/KubeArmor/go.mod

Lines 22 to 24 in 2142379

    
           k8s.io/api => k8s.io/api v0.26.4 
        
           k8s.io/apimachinery => k8s.io/apimachinery v0.26.4 
        
           k8s.io/client-go => k8s.io/client-go v0.26.4

rootxrishabh · 2024-01-10T13:46:05Z

@DelusionalOptimist I'll get it done.

Signed-off-by: rootxrishabh <[email protected]>

rootxrishabh · 2024-01-10T14:33:56Z

@DelusionalOptimist There are some build errors, fixing them might require dependency updates. If yes, should we upgrade dependencies across Kubearmor?

rootxrishabh · 2024-01-11T20:22:01Z

Kubearmor Controller uses configurations such as MetricsBindAddress and port which were present in current package controller-runtime:0.14.x but have been removed in latest. Should we explore to reconfigure the controller or stick to old release?

Signed-off-by: rootxrishabh <[email protected]>

rootxrishabh · 2024-01-11T22:01:50Z

libbpf-based vulnerabilities are still present as the patch is yet to be released across all releases.

rootxrishabh · 2024-01-11T22:41:24Z

Kubearmor Controller uses configurations such as MetricsBindAddress and port which were present in current package controller-runtime:0.14.x but have been removed in latest. Should we explore to reconfigure the controller or stick to old release?

Shifting to an older release makes sense as of now.

rootxrishabh · 2024-01-11T22:42:13Z

@nyrahul failing snyk tests require maintainers access, could you please take a look?

DelusionalOptimist · 2024-01-12T11:38:54Z

Kubearmor Controller uses configurations such as MetricsBindAddress and port which were present in current package controller-runtime:0.14.x but have been removed in latest. Should we explore to reconfigure the controller or stick to old release?

Shifting to an older release makes sense as of now.

Sure, we can handle these later as per need. 👍

DelusionalOptimist

All other updates look good. 👍

pkg/KubeArmorController/go.mod

DelusionalOptimist · 2024-01-12T11:50:00Z

libbpf-based vulnerabilities are still present as the patch is yet to be released across all releases.

cc @daemon1024

daemon1024 · 2024-01-12T11:57:32Z

I believe the libbpf vulnerability is due it existing as a submodule right?
I have created this issue to track that #1580
Even if the fix is released, it won't be a simple update for us.

daemon1024 · 2024-01-12T12:09:21Z

protobuf/go.mod

-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/net v0.17.0 // indirect


https://security.snyk.io/vuln/SNYK-GOLANG-GOLANGORGXCRYPTOSSH-6130669

golang.org/x/[email protected] › golang.org/x/[email protected]

Snyk failure cause

Upgraded to golang.org/x/[email protected] uses golang.org/x/crypto v0.18.0, still snyk fails. Am I missing something?

Upgraded to golang.org/x/[email protected] uses golang.org/x/crypto v0.18.0, still snyk fails. Am I missing something?

Solved!
Could you provide a bit more insight on security/snyk (nyrahul) ?

https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOJOSEGOJOSE-6070736
Snyk failure cause

@Aryan-sharma11 I test all our go.mod files using snyk CLI. Other than golang.org/x/net/[email protected](low risk vuln, fix yet to implemented upstream) I can't find any vulnerability. Also, github.com/go-jose/go-jose is a transitive dependency to a package. Can we ignore this?

Signed-off-by: Rudraksh Pareek <[email protected]>

Signed-off-by: rootxrishabh <[email protected]> standardized controller-runtime version Signed-off-by: rootxrishabh <[email protected]> x/net updated Signed-off-by: rootxrishabh <[email protected]> Tested snyk locally Signed-off-by: rootxrishabh <[email protected]> test changes reverted Signed-off-by: rootxrishabh <[email protected]> controller-runtime version reverted Signed-off-by: rootxrishabh <[email protected]> version reverted to 1.20 Signed-off-by: rootxrishabh <[email protected]> test go.mod updated Signed-off-by: rootxrishabh <[email protected]> test go.mod updated Signed-off-by: rootxrishabh <[email protected]> Errors fixed Signed-off-by: rootxrishabh <[email protected]>

Signed-off-by: rootxrishabh <[email protected]>

Signed-off-by: Rudraksh Pareek <[email protected]>

…ptimist/feat/extended-vm-support feat(*): extended VM support

We did not have fallback logic to read from procfs in case of operation File/Network Enabled the fallback logic for file/network telemetry Signed-off-by: daemon1024 <[email protected]>

fix(monitor): Missing Source in Telemetry

Signed-off-by: rootxrishabh <[email protected]>

…KubeArmor into updateDependencies Signed-off-by: rootxrishabh <[email protected]>

fix(deps): updated vulnerable dependencies

6e9f997

Signed-off-by: rootxrishabh <[email protected]>

Merge branch 'kubearmor:main' into updateDependencies

1c19e0a

removed k8s.io replace directives

9909ad0

Signed-off-by: rootxrishabh <[email protected]>

rootxrishabh added 2 commits January 11, 2024 21:08

Dependencies updated

ea93c40

Signed-off-by: rootxrishabh <[email protected]>

toolchain removed

372cf9e

Signed-off-by: rootxrishabh <[email protected]>

rootxrishabh requested a review from DelusionalOptimist January 11, 2024 22:42

DelusionalOptimist reviewed Jan 12, 2024

View reviewed changes

pkg/KubeArmorController/go.mod Outdated Show resolved Hide resolved

daemon1024 reviewed Jan 12, 2024

View reviewed changes

rootxrishabh linked an issue Jan 16, 2024 that may be closed by this pull request

Improve Scorecard Score for Kubearmor #1532

Open

15 tasks

DelusionalOptimist added 7 commits January 18, 2024 15:44

send protected objects with state agent

f45729f

Signed-off-by: Rudraksh Pareek <[email protected]>

udpate protobufs

bc24057

Signed-off-by: Rudraksh Pareek <[email protected]>

refactor feeder and add reverse services

9a621e0

Signed-off-by: Rudraksh Pareek <[email protected]>

iterate runtime socket map in order

2fbceac

Signed-off-by: Rudraksh Pareek <[email protected]>

cleanup protos

34efdaf

Signed-off-by: Rudraksh Pareek <[email protected]>

refactor: improve implementation by preserving interfaces

f9acb19

Signed-off-by: Rudraksh Pareek <[email protected]>

chores and address review comments

8c95ee6

Signed-off-by: Rudraksh Pareek <[email protected]>

rootxrishabh force-pushed the updateDependencies branch from 4173b3c to bf74f1f Compare January 19, 2024 20:36

rootxrishabh added 2 commits January 19, 2024 20:40

go.sum updated

13992dd

Signed-off-by: rootxrishabh <[email protected]>

rootxrishabh force-pushed the updateDependencies branch from bf74f1f to 13992dd Compare January 19, 2024 20:40

DelusionalOptimist and others added 6 commits January 22, 2024 11:38

syncup go mods; lint & protos

f642a76

Signed-off-by: Rudraksh Pareek <[email protected]>

Merge pull request kubearmor#1448 from DelusionalOptimist/delusionalo…

2bac1d1

…ptimist/feat/extended-vm-support feat(*): extended VM support

fix(monitor): Missing Source in Telemetry

c5e150e

We did not have fallback logic to read from procfs in case of operation File/Network Enabled the fallback logic for file/network telemetry Signed-off-by: daemon1024 <[email protected]>

Merge pull request kubearmor#1587 from daemon1024/fix-no-source-alerts

47d3c5c

fix(monitor): Missing Source in Telemetry

Conflicts resolved

c42ccfa

Signed-off-by: rootxrishabh <[email protected]>

Merge branch 'updateDependencies' of https://github.com/rootxrishabh/…

5441065

…KubeArmor into updateDependencies Signed-off-by: rootxrishabh <[email protected]>

rootxrishabh closed this Jan 24, 2024

rootxrishabh deleted the updateDependencies branch January 24, 2024 19:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): updated vulnerable dependencies #1567

fix(deps): updated vulnerable dependencies #1567

rootxrishabh commented Dec 29, 2023

DelusionalOptimist commented Jan 10, 2024

rootxrishabh commented Jan 10, 2024

rootxrishabh commented Jan 10, 2024

rootxrishabh commented Jan 11, 2024

rootxrishabh commented Jan 11, 2024

rootxrishabh commented Jan 11, 2024

rootxrishabh commented Jan 11, 2024

DelusionalOptimist commented Jan 12, 2024

DelusionalOptimist left a comment

DelusionalOptimist commented Jan 12, 2024

daemon1024 commented Jan 12, 2024 •

edited

Loading

daemon1024 Jan 12, 2024

rootxrishabh Jan 12, 2024

rootxrishabh Jan 13, 2024

Aryan-sharma11 Jan 19, 2024

rootxrishabh Jan 19, 2024 •

edited

Loading

fix(deps): updated vulnerable dependencies #1567

fix(deps): updated vulnerable dependencies #1567

Conversation

rootxrishabh commented Dec 29, 2023

DelusionalOptimist commented Jan 10, 2024

rootxrishabh commented Jan 10, 2024

rootxrishabh commented Jan 10, 2024

rootxrishabh commented Jan 11, 2024

rootxrishabh commented Jan 11, 2024

rootxrishabh commented Jan 11, 2024

rootxrishabh commented Jan 11, 2024

DelusionalOptimist commented Jan 12, 2024

DelusionalOptimist left a comment

Choose a reason for hiding this comment

DelusionalOptimist commented Jan 12, 2024

daemon1024 commented Jan 12, 2024 • edited Loading

daemon1024 Jan 12, 2024

Choose a reason for hiding this comment

rootxrishabh Jan 12, 2024

Choose a reason for hiding this comment

rootxrishabh Jan 13, 2024

Choose a reason for hiding this comment

Aryan-sharma11 Jan 19, 2024

Choose a reason for hiding this comment

rootxrishabh Jan 19, 2024 • edited Loading

Choose a reason for hiding this comment

daemon1024 commented Jan 12, 2024 •

edited

Loading

rootxrishabh Jan 19, 2024 •

edited

Loading