OCPBUGS-5667: CVE-2021-4238: goutils: update for randomness fix #6764

r4f4 · 2023-01-11T18:51:21Z

A flaw was found in goutils where randomly generated alphanumeric
strings contain significantly less entropy than expected. Both the
RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always
return strings containing at least one digit from 0 to 9. This issue
significantly reduces the amount of entropy generated in short strings
by these functions.

openshift-ci-robot · 2023-01-11T18:51:24Z

@r4f4: This pull request references Jira Issue OCPBUGS-5667, which is invalid:

expected Jira Issue OCPBUGS-5667 to depend on a bug targeting a version in 4.13.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

A flaw was found in goutils where randomly generated alphanumeric
strings contain significantly less entropy than expected. Both the
RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always
return strings containing at least one digit from 0 to 9. This issue
significantly reduces the amount of entropy generated in short strings
by these functions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-01-11T18:51:31Z

@r4f4: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

Details

In response to this:

OCPBUGS-5667: CVE-2021-4238: goutils: update for randomness fix

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

barbacbd · 2023-01-12T13:39:19Z

/test e2e-vsphere-ovn

r4f4 · 2023-01-12T14:03:21Z

This is a manual cherry-pick of #6763

r4f4 · 2023-01-12T14:04:46Z

/jira refresh

openshift-ci-robot · 2023-01-12T14:04:50Z

@r4f4: This pull request references Jira Issue OCPBUGS-5667, which is invalid:

expected dependent Jira Issue OCPBUGS-5770 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

barbacbd · 2023-01-16T12:53:17Z

/test e2e-openstack-ovn

barbacbd · 2023-01-16T12:54:45Z

This a pretty old fix (about a year). This should probably be back ported several version right?

r4f4 · 2023-01-16T13:04:12Z

This a pretty old fix (about a year). This should probably be back ported several version right?

Yes. I have PRs up for master until 4.10. For 4.9 I'm facing some issues with go mod tidy so no PR yet.

r4f4 · 2023-01-20T14:40:48Z

/jira refresh

openshift-ci-robot · 2023-01-20T14:40:54Z

@r4f4: This pull request references Jira Issue OCPBUGS-5667, which is valid.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.z) matches configured target version for branch (4.12.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-5770 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
dependent Jira Issue OCPBUGS-5770 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @gpei

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

barbacbd

/lgtm

sadasu · 2023-01-20T15:47:56Z

/approve

openshift-ci · 2023-01-20T15:48:30Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sadasu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [sadasu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sadasu · 2023-01-20T15:48:43Z

/label backport-risk-assessed

gpei · 2023-01-25T06:27:09Z

/label cherry-pick-approved

openshift-ci-robot · 2023-01-25T07:06:45Z

/retest-required

Remaining retests: 0 against base HEAD 303c9d4 and 2 for PR HEAD 066b559c4a4674d8de3a38bae19ab120151ed122 in total

openshift-ci-robot · 2023-01-25T13:13:13Z

/retest-required

Remaining retests: 0 against base HEAD 59bb8eb and 1 for PR HEAD 066b559c4a4674d8de3a38bae19ab120151ed122 in total

openshift-ci-robot · 2023-01-27T10:07:46Z

/retest-required

Remaining retests: 0 against base HEAD 7fea1c4 and 0 for PR HEAD 066b559c4a4674d8de3a38bae19ab120151ed122 in total

A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issue significantly reduces the amount of entropy generated in short strings by these functions.

r4f4 · 2023-02-01T17:46:56Z

Rebased to solve merge conflicts.

barbacbd

/lgtm

openshift-ci-robot · 2023-02-01T20:08:25Z

/retest-required

Remaining retests: 0 against base HEAD 7fea1c4 and 2 for PR HEAD 6bdb394 in total

openshift-ci · 2023-02-01T21:47:39Z

@r4f4: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-alibaba	`6bdb394`	link	false	`/test e2e-alibaba`
ci/prow/e2e-openstack-proxy	`6bdb394`	link	false	`/test e2e-openstack-proxy`
ci/prow/okd-scos-e2e-aws-ovn	`6bdb394`	link	false	`/test okd-scos-e2e-aws-ovn`
ci/prow/e2e-openstack-sdn-parallel	`6bdb394`	link	false	`/test e2e-openstack-sdn-parallel`
ci/prow/okd-e2e-aws-ovn-upgrade	`6bdb394`	link	false	`/test okd-e2e-aws-ovn-upgrade`
ci/prow/e2e-crc	`6bdb394`	link	false	`/test e2e-crc`
ci/prow/e2e-aws-ovn-disruptive	`6bdb394`	link	false	`/test e2e-aws-ovn-disruptive`
ci/prow/e2e-aws-ovn-workers-rhel8	`6bdb394`	link	false	`/test e2e-aws-ovn-workers-rhel8`
ci/prow/okd-scos-e2e-aws-upgrade	`6bdb394`	link	false	`/test okd-scos-e2e-aws-upgrade`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-02-01T21:51:31Z

@r4f4: All pull requests linked via external trackers have merged:

openshift/installer#6764

Jira Issue OCPBUGS-5667 has been moved to the MODIFIED state.

Details

In response to this:

A flaw was found in goutils where randomly generated alphanumeric
strings contain significantly less entropy than expected. Both the
RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always
return strings containing at least one digit from 0 to 9. This issue
significantly reduces the amount of entropy generated in short strings
by these functions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jan 11, 2023

openshift-ci bot requested review from barbacbd and rna-afk January 11, 2023 18:53

openshift-ci bot requested a review from gpei January 20, 2023 14:40

barbacbd reviewed Jan 20, 2023

View reviewed changes

openshift-ci bot assigned barbacbd Jan 20, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 20, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 20, 2023

openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jan 20, 2023

openshift-ci bot added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jan 25, 2023

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 27, 2023

r4f4 added 9 commits February 1, 2023 18:46

terraform: bump goutils for CVE fix

1bf34aa

terraform: alicloud: bump goutils for CVE fix

7799872

terraform: google: bump goutils for CVE fix

b73d3a1

terraform: nutanix: bump goutils for CVE fix

9497f19

terraform: openstack: bump goutils for CVE fix

2939849

terraform: time: bump goutils for CVE fix

8b41309

terraform: vsphere: bump goutils for CVE fix

22ac5f3

terraform: vsphereprivate: bump goutils for CVE fix

6bdb394

r4f4 force-pushed the cve-goutils-4.12 branch from 066b559 to 6bdb394 Compare February 1, 2023 17:46

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 1, 2023

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Feb 1, 2023

barbacbd reviewed Feb 1, 2023

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 1, 2023

openshift-merge-robot merged commit 62cfbfc into openshift:release-4.12 Feb 1, 2023

OCPBUGS-5667: CVE-2021-4238: goutils: update for randomness fix #6764

OCPBUGS-5667: CVE-2021-4238: goutils: update for randomness fix #6764

Uh oh!

Conversation

r4f4 commented Jan 11, 2023

Uh oh!

openshift-ci-robot commented Jan 11, 2023

Uh oh!

openshift-ci bot commented Jan 11, 2023

Uh oh!

barbacbd commented Jan 12, 2023

Uh oh!

r4f4 commented Jan 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

r4f4 commented Jan 12, 2023

Uh oh!

openshift-ci-robot commented Jan 12, 2023

Uh oh!

barbacbd commented Jan 16, 2023

Uh oh!

barbacbd commented Jan 16, 2023

Uh oh!

r4f4 commented Jan 16, 2023

Uh oh!

r4f4 commented Jan 20, 2023

Uh oh!

openshift-ci-robot commented Jan 20, 2023

Uh oh!

barbacbd left a comment

Choose a reason for hiding this comment

Uh oh!

sadasu commented Jan 20, 2023

Uh oh!

openshift-ci bot commented Jan 20, 2023

Uh oh!

sadasu commented Jan 20, 2023

Uh oh!

gpei commented Jan 25, 2023

Uh oh!

openshift-ci-robot commented Jan 25, 2023

Uh oh!

openshift-ci-robot commented Jan 25, 2023

Uh oh!

openshift-ci-robot commented Jan 27, 2023

Uh oh!

r4f4 commented Feb 1, 2023

Uh oh!

barbacbd left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Feb 1, 2023

Uh oh!

openshift-ci bot commented Feb 1, 2023

Uh oh!

openshift-ci-robot commented Feb 1, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

r4f4 commented Jan 12, 2023 •

edited

Loading