OCPBUGS-79856: Bump Bump google.golang.org/grpc - #179
Conversation
openshift-ci-robot
added
jira/severity-important
|
@sbiradar10: This pull request references Jira Issue OCPBUGS-79856, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Walkthrough
Changesgo.mod Dependency Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning, 1 inconclusive)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/lgtm |
openshift-ci
Bot
added
the
approved
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@sbiradar10: This pull request references Jira Issue OCPBUGS-79856, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
go.mod (1)
5-29: 🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick winSupply chain: Add justification and context to the PR description per coding guidelines.
The PR description does not explain the dependency changes required by the coding guidelines for supply chain security. Please add or reference a section that covers:
- Upstream requirement: Why are these specific versions required? Is this driven by Kubernetes/CSI version constraints, upstream PR
#3940, or OpenShift release requirements?- CVE risk acceptance: For golang.org/x/crypto, oauth2, and OpenTelemetry flagged vulnerabilities, document the risk acceptance or mitigation strategy.
- License compatibility: Confirm that all bumped/added dependencies maintain license compatibility with the project's existing licenses (typically Apache 2.0 for Kubernetes projects).
- Fork justification (gRPC): Explain the decision to use the OpenShift-sustaining fork instead of upstream.
- Release readiness: Confirm this PR does not introduce yanked or pre-release versions in production-intended code.
Additionally, verify that your build pipeline generates SBOM (Software Bill of Materials) and provenance attestations for release artifacts, as indicated by the coding guidelines' requirement for supply chain integrity.
Also applies to: 45-183, 185-228
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 5 - 29, The PR description lacks required supply chain security documentation per coding guidelines. Update the PR description to include: (1) upstream requirements explaining why these specific dependency versions are necessary and whether driven by Kubernetes/CSI version constraints, upstream PR `#3940`, or OpenShift release requirements, (2) CVE risk acceptance documentation for golang.org/x/crypto, oauth2, and OpenTelemetry flagged vulnerabilities including mitigation strategies, (3) license compatibility confirmation that all bumped/added dependencies maintain compatibility with the project's existing licenses (typically Apache 2.0), (4) justification for using the OpenShift-sustaining fork for gRPC instead of upstream, (5) release readiness confirmation that no yanked or pre-release versions are introduced for production code, and (6) verification that the build pipeline generates SBOM and provenance attestations for release artifacts as required by supply chain integrity guidelines.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 153: Update the golang.org/x/oauth2 dependency from v0.18.0 to v0.27.0 or
later in go.mod to patch the GO-2025-3488 memory exhaustion vulnerability during
token parsing. Additionally, locate and upgrade the go.opentelemetry.io/contrib
dependency from v0.20.0 to v0.44.0 or later in go.mod to address the
GHSA-rcjv-mgp8-qvmr denial of service vulnerability in otelhttp instrumentation.
Run go mod tidy after updating these versions to ensure consistency and resolve
any transitive dependencies.
- Line 25: The golang.org/x/crypto dependency at version v0.24.0 contains
multiple known security vulnerabilities (CVE-2024-45337, GO-2025-3487,
GO-2025-4134, GO-2025-4135, GO-2025-4116) affecting the ssh package including
authorization bypass, denial of service, and unbounded memory consumption
issues. Update the golang.org/x/crypto version in go.mod from v0.24.0 to v0.31.0
or later to resolve these vulnerabilities.
- Line 228: The gRPC replace directive for google.golang.org/grpc pointing to
the openshift-sustaining fork lacks documentation explaining the supply chain
decision. Add explicit documentation (such as comments in the go.mod file, or in
a SECURITY.md or CONTRIBUTING.md file) that explains why the fork is used
instead of upstream versions (Go toolchain stability for specific release
branches), how security updates are evaluated and backported (including the
reasoning for CVE-2026-33186), and the process for upgrading to new upstream
gRPC versions. This will provide reviewers with transparency about the fork
usage without requiring external research.
---
Outside diff comments:
In `@go.mod`:
- Around line 5-29: The PR description lacks required supply chain security
documentation per coding guidelines. Update the PR description to include: (1)
upstream requirements explaining why these specific dependency versions are
necessary and whether driven by Kubernetes/CSI version constraints, upstream PR
`#3940`, or OpenShift release requirements, (2) CVE risk acceptance documentation
for golang.org/x/crypto, oauth2, and OpenTelemetry flagged vulnerabilities
including mitigation strategies, (3) license compatibility confirmation that all
bumped/added dependencies maintain compatibility with the project's existing
licenses (typically Apache 2.0), (4) justification for using the
OpenShift-sustaining fork for gRPC instead of upstream, (5) release readiness
confirmation that no yanked or pre-release versions are introduced for
production code, and (6) verification that the build pipeline generates SBOM and
provenance attestations for release artifacts as required by supply chain
integrity guidelines.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c1940807-49f4-41cb-a228-039174a88ea0
⛔ Files ignored due to path filters (299)
go.sumis excluded by!**/*.sumvendor/cloud.google.com/go/compute/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/internal/version.gois excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/metadata/CHANGES.mdis excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/metadata/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/metadata/README.mdis excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/metadata/metadata.gois excluded by!**/vendor/**,!vendor/**vendor/cloud.google.com/go/compute/metadata/tidyfix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/testall.shis excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_asm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_other.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_safe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/capture_metrics.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/wrap_generated_gteq_1.8.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/felixge/httpsnoop/wrap_generated_lt_1.8.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/descriptor/descriptor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/decode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/jsonpb/json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/golang/protobuf/ptypes/any.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/cmpopts/equate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/cmpopts/ignore.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/cmpopts/sort.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/cmpopts/xform.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/compare.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/export.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/export_panic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/internal/value/pointer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/internal/value/pointer_purego.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/path.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/go-cmp/cmp/report_reflect.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/pprof/profile/encode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/pprof/profile/filter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/pprof/profile/legacy_profile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/pprof/profile/merge.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/pprof/profile/profile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/pprof/profile/proto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/pprof/profile/prune.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/hash.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/node_js.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/time.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/uuid.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version6.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/uuid/version7.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/internal/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/internal/errors.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/internal/errors.protois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/runtime/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/runtime/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/runtime/fieldmask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/runtime/mux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/runtime/proto_errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/runtime/query.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/utilities/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/compile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/fuzz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/parse.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/convert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/fieldmask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_httpbodyproto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_proto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler_registry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/pattern.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/proto2_convert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/query.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/pattern.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/readerfactory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/string_array_flag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/trie.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/prometheus/client_model/go/metrics.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_compare.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_format.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_forward.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertion_order.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/assertions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stretchr/testify/assert/http_assertions.gois excluded by!**/vendor/**,!vendor/**vendor/go.opencensus.io/Makefileis excluded by!**/vendor/**,!vendor/**vendor/go.opencensus.io/opencensus.gois excluded by!**/vendor/**,!vendor/**vendor/go.opencensus.io/trace/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opencensus.io/trace/lrumap.gois excluded by!**/vendor/**,!vendor/**vendor/go.opencensus.io/trace/trace_go11.gois excluded by!**/vendor/**,!vendor/**vendor/go.opencensus.io/trace/trace_nongo11.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/collector/metrics/v1/metrics_service.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/collector/metrics/v1/metrics_service.pb.gw.gois excluded by!**/*.pb.gw.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/collector/metrics/v1/metrics_service_grpc.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_config.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.gw.gois excluded by!**/*.pb.gw.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service_grpc.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/common/v1/common.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/metrics/v1/metrics.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/resource/v1/resource.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/proto/otlp/trace/v1/trace.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/bits_compat.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_generic.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/ssh/client_auth.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/ssh/keys.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/crypto/ssh/server.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/ctxhttp/ctxhttp.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/go17.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/go19.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/pre_go17.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/context/pre_go19.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/doc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/html/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http/httpguts/httplex.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/databuffer.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/go111.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/go115.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/not_go111.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/not_go115.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/not_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/pipe.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/timer.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/http2/writesched_priority.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/idna10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/idna9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/pre_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables10.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables11.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables15.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/tables9.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/trie12.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/idna/trie13.0.0.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/proxy/per_host.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/client.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/dial.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/hybi.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/net/websocket/websocket.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/CONTRIBUTORSis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/README.mdis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/client_appengine.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/internal/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/semaphore/semaphore.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sync/singleflight/singleflight.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_gc_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/asm_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/bpxsvc_zos.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/epoll_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/fstatfs_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/mmap_nomremap.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/pagesize_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/readdirent_getdirentries.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sockcmsg_zos.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/symaddr_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_darwin_libSystem.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_freebsd.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/syscall_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sysvshm_unix.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/sysvshm_unix_other.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zerrors_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsymaddr_zos_s390x.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/unix/ztypes_zos_s390x.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/aliases.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/empty.sis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/env_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/time/AUTHORSis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/time/CONTRIBUTORSis excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/time/rate/rate.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/time/rate/sometimes.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/go/ast/inspector/typeof.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/common.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/coretype.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/enabled_go117.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/enabled_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/normalize.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/termlist.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/typeparams_go117.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/typeparams_go118.gois excluded by!**/vendor/**,!vendor/**vendor/golang.org/x/tools/internal/typeparams/typeterm.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/api.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/api_classic.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/api_common.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity_classic.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity_flex.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/identity_vm.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/main.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/main_vm.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/internal/transaction.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/appengine/urlfetch/urlfetch.gois excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**
📒 Files selected for processing (1)
go.mod
| golang.org/x/sync v0.1.0 | ||
| google.golang.org/grpc v1.47.0 | ||
| google.golang.org/protobuf v1.28.1 | ||
| golang.org/x/crypto v0.24.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, find and inspect the go.mod file
find . -name "go.mod" -type fRepository: openshift/vmware-vsphere-csi-driver
Length of output: 88
🏁 Script executed:
# Check the golang.org/x/crypto version in go.mod (around line 25)
if [ -f "go.mod" ]; then
sed -n '20,35p' go.mod
fiRepository: openshift/vmware-vsphere-csi-driver
Length of output: 611
🌐 Web query:
golang.org/x/crypto v0.24.0 vulnerabilities CVE
💡 Result:
The version golang.org/x/crypto v0.24.0 is affected by multiple security vulnerabilities [1][2], most notably the authorization bypass vulnerability tracked as CVE-2024-45337 [3][4][5]. Key details regarding vulnerabilities in v0.24.0: CVE-2024-45337 (also identified as GO-2024-3321 and GHSA-v778-237x-gjrc): This vulnerability involves the misuse of the ServerConfig.PublicKeyCallback in the ssh package [2][6][5]. Because the SSH protocol allows clients to probe whether a public key is acceptable before proving control of the private key, applications that improperly rely on the order or receipt of keys in this callback may be susceptible to authorization bypass [3][7][5]. This was addressed in version v0.31.0 [4][6][5]. Additional Security Advisories: Beyond CVE-2024-45337, version v0.24.0 is associated with several other security advisories listed in the Go vulnerability database, including [1]: - GO-2025-3487 / GHSA-hcg3-q754-cr77: Potential denial of service via slow or incomplete key exchange [2]. - GO-2025-4134 / GHSA-j5w8-q4qc-rx2x: Unbounded memory consumption in the ssh package [2]. - GO-2025-4135 / GHSA-f6x5-jh6r-wrfv: Potential panic due to malformed messages in ssh/agent [2]. - GO-2025-4116: Potential denial of service in ssh/agent [2]. Given these findings, users are advised to upgrade to a significantly newer version of golang.org/x/crypto to remediate these issues [8]. As of June 2026, version v0.24.0 is considered outdated and vulnerable [1][9].
Citations:
- 1: https://pkg.go.dev/golang.org/x/crypto@v0.24.0
- 2: https://deps.dev/go/golang.org%2Fx%2Fcrypto/v0.24.0
- 3: https://osv.dev/vulnerability/CVE-2024-45337
- 4: https://cve.circl.lu/cve/CVE-2024-45337
- 5: https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q
- 6: x/vulndb: potential Go vuln in golang.org/x/crypto: GHSA-v778-237x-gjrc golang/vulndb#3328
- 7: https://test.osv.dev/vulnerability/CVE-2024-45337
- 8: https://security.snyk.io/package/golang/golang.org%2Fx%2Fcrypto
- 9: https://shoulder.dev/go/golang.org/x/crypto/v0.24.0
golang.org/x/crypto v0.24.0 contains verified authorization bypass and DoS vulnerabilities requiring upgrade.
The pinned version golang.org/x/crypto v0.24.0 (line 26) has multiple confirmed security vulnerabilities affecting the ssh package:
- CVE-2024-45337 (GHSA-v778-237x-gjrc): Authorization bypass via improper ServerConfig.PublicKeyCallback handling—attackers can probe public key acceptance without proving key control
- GO-2025-3487 (GHSA-hcg3-q754-cr77): Denial of service via slow or incomplete key exchange
- GO-2025-4134 (GHSA-j5w8-q4qc-rx2x): Unbounded memory consumption in ssh package
- GO-2025-4135 (GHSA-f6x5-jh6r-wrfv): Potential panic in ssh/agent due to malformed messages
- GO-2025-4116: Additional denial of service in ssh/agent
As of June 2026, v0.24.0 is outdated and unsafe for production. Upgrade to v0.31.0 or later to resolve these issues.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
(GO-2024-3321)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4116)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Unbounded memory consumption in golang.org/x/crypto/ssh
(GO-2025-4134)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
(GO-2025-4135)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
(GO-2026-5005)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(GO-2026-5006)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
(GO-2026-5013)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
(GO-2026-5014)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
(GO-2026-5015)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
(GO-2026-5016)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(GO-2026-5017)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
(GO-2026-5018)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(GO-2026-5019)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
(GO-2026-5020)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(GO-2026-5021)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(GO-2026-5023)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
(GO-2026-5033)
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
[CRITICAL] 25-25: golang.org/x/crypto 0.24.0: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 25, The golang.org/x/crypto dependency at version v0.24.0
contains multiple known security vulnerabilities (CVE-2024-45337, GO-2025-3487,
GO-2025-4134, GO-2025-4135, GO-2025-4116) affecting the ssh package including
authorization bypass, denial of service, and unbounded memory consumption
issues. Update the golang.org/x/crypto version in go.mod from v0.24.0 to v0.31.0
or later to resolve these vulnerabilities.
Source: Linters/SAST tools
| golang.org/x/text v0.14.0 // indirect | ||
| golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect | ||
| golang.org/x/tools v0.6.0 // indirect | ||
| golang.org/x/oauth2 v0.18.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cd . && head -160 go.mod | tail -30Repository: openshift/vmware-vsphere-csi-driver
Length of output: 1740
🌐 Web query:
golang.org/x/oauth2 v0.18.0 CVE GO-2025-3488 GHSA-6v2p-p543-phr9
💡 Result:
The vulnerability identified as GO-2025-3488 (also tracked as CVE-2025-22868 and GHSA-6v2p-p543-phr9) affects the golang.org/x/oauth2 package [1][2][3]. The vulnerability is described as an improper validation of the syntactic correctness of input [2]. Specifically, an attacker can pass a malicious, malformed token to the library, which causes unexpected memory consumption during parsing [1][2]. This vulnerability carries a High severity rating (CVSS score of 7.5) and is primarily associated with the Verify symbol in the golang.org/x/oauth2/jws package [2][3]. This issue was fixed in version 0.27.0 of golang.org/x/oauth2 [2][3]. Users running earlier versions, including v0.18.0, are encouraged to update their dependencies to at least v0.27.0 to mitigate this risk.
Citations:
- 1: https://pkg.go.dev/vuln/GO-2025-3488
- 2: https://osv.dev/vulnerability/GHSA-6v2p-p543-phr9
- 3: https://osv.dev/GO-2025-3488
🌐 Web query:
go.opentelemetry.io/contrib v0.20.0 CVE GHSA-rcjv-mgp8-qvmr GO-2023-2113
💡 Result:
The vulnerability identified by GHSA-rcjv-mgp8-qvmr, CVE-2023-45142, and GO-2023-2113 is a Denial of Service (DoS) issue caused by uncontrolled resource consumption in the otelhttp instrumentation of the OpenTelemetry-Go Contrib library [1][2][3]. Specifically, the otelhttp handler wrapper collected HTTP request attributes (such as http.user_agent and http.method) with unbound cardinality, which could lead to server memory exhaustion when processing a large number of malicious requests [2][4]. This vulnerability was addressed and fixed in version 0.44.0 of the affected packages [1][3]. In that release, the values collected for attributes like http.request.method were restricted to a set of well-known values, and other high-cardinality attributes were removed [1][2]. Regarding the version v0.20.0 specifically, it is a very old version of the OpenTelemetry-Go Contrib repository, released in April 2021 [5], and it predates the discovery and patching of this vulnerability [1][3]. Users of older versions are advised to upgrade to a version containing the fix [2].
Citations:
- 1: GHSA-rcjv-mgp8-qvmr
- 2: https://osv.dev/vulnerability/GHSA-rcjv-mgp8-qvmr
- 3: https://pkg.go.dev/vuln/GO-2023-2113
- 4: https://cve.circl.lu/vuln/ghsa-rcjv-mgp8-qvmr
- 5: open-telemetry/opentelemetry-go-contrib@0e5bef9
Upgrade golang.org/x/oauth2 and go.opentelemetry.io/contrib to patch known vulnerabilities before release.
golang.org/x/oauth2 v0.18.0 has two critical security issues:
- GO-2025-3488 / GHSA-6v2p-p543-phr9: Memory exhaustion vulnerability during token parsing (CVSS 7.5). Fixed in v0.27.0.
go.opentelemetry.io/contrib v0.20.0 has:
- GHSA-rcjv-mgp8-qvmr / GO-2023-2113: Denial of Service via unbound cardinality metrics in otelhttp instrumentation. Fixed in v0.44.0.
Upgrade to patched versions or document and accept the security risk explicitly.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 153-153: golang.org/x/oauth2 0.18.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 153-153: golang.org/x/oauth2 0.18.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 153, Update the golang.org/x/oauth2 dependency from v0.18.0
to v0.27.0 or later in go.mod to patch the GO-2025-3488 memory exhaustion
vulnerability during token parsing. Additionally, locate and upgrade the
go.opentelemetry.io/contrib dependency from v0.20.0 to v0.44.0 or later in
go.mod to address the GHSA-rcjv-mgp8-qvmr denial of service vulnerability in
otelhttp instrumentation. Run go mod tidy after updating these versions to
ensure consistency and resolve any transitive dependencies.
Source: Linters/SAST tools
|
|
||
| ) | ||
|
|
||
| replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, confirm the replace directive exists in go.mod
head -n 240 go.mod | tail -n 20Repository: openshift/vmware-vsphere-csi-driver
Length of output: 1063
🏁 Script executed:
# Search for any documentation or comments about the gRPC fork
rg -i "grpc|openshift.sustaining" --type md --type txt -A 3 -B 3Repository: openshift/vmware-vsphere-csi-driver
Length of output: 50393
🏁 Script executed:
# Check if there's a SECURITY.md or similar documentation
fd -i "security\|codeowners\|contributing" -t fRepository: openshift/vmware-vsphere-csi-driver
Length of output: 61
🏁 Script executed:
# Look for any inline comments in go.mod about this replace directive
head -n 250 go.mod | tail -n 30Repository: openshift/vmware-vsphere-csi-driver
Length of output: 1613
🏁 Script executed:
# Search for any comments or references to the grpc fork in the codebase
rg -i "openshift.sustaining|grpc.fork|sec\\.1" --type go --type md --type txt -B 3 -A 3Repository: openshift/vmware-vsphere-csi-driver
Length of output: 5882
🏁 Script executed:
# Check if there's any explanation in CONTRIBUTING, README, or similar files
fd -i "readme\|contributing\|security\|changelog" -t f | head -20Repository: openshift/vmware-vsphere-csi-driver
Length of output: 61
🏁 Script executed:
# Look for any git history or comments that might explain this choice
cat go.mod | grep -A 5 -B 5 "google.golang.org/grpc"Repository: openshift/vmware-vsphere-csi-driver
Length of output: 2389
🌐 Web query:
openshift-sustaining grpc-go fork v1.64.1-sec.1
💡 Result:
The github.com/openshift-sustaining/grpc-go repository provides security-patched backports of the upstream gRPC-Go library specifically for OpenShift components [1][2][3]. The version v1.64.1-sec.1 is a specific patched release used within the OpenShift ecosystem to remediate CVE-2026-33186 [4][1][5]. This vulnerability involves an authorization bypass in the gRPC-Go server caused by malformed:path headers [3]. Key details regarding this fork and version include: - Purpose: The primary reason for using this sustaining fork is to apply critical security patches (such as the fix for CVE-2026-33186) while maintaining compatibility with older Go compiler versions used in specific OpenShift release branches (e.g., Go 1.22) [2][3][6]. Upgrading to the upstream-patched versions of gRPC-Go often requires newer Go versions that would force an unwanted compiler toolchain upgrade for those branches [2][6]. - Implementation: It is implemented in Go projects by adding a replace directive in the go.mod file [1][7][2]: replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 - Ecosystem usage: Similar patched releases (e.g., v1.71.3-sec.1, v1.75.1-sec.1) are also utilized across other OpenShift release branches to address the same CVE while adhering to specific branch-level Go toolchain requirements [8][9][2][6].
Citations:
- 1: [Release-4.15] OCPBUGS-86345: Update grpc-go to v1.64.1-sec.1 to fix CVE-2026-33186 cluster-olm-operator#208
- 2: OCPBUGS-80077: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 csi-driver-nfs#181
- 3: [release-4.18] OCPBUGS-80278: fix CVE-2026-33186 by replacing grpc-go hypershift#8515
- 4: OCPBUGS-84927: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 csi-driver-nfs#186
- 5: OCPBUGS-84928: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 csi-driver-nfs#185
- 6: OCPBUGS-80311,OCPBUGS-80312,OCPBUGS-80313: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.18] operator-framework-olm#1314
- 7: openshift/csi-driver-nfs@61772d7
- 8: OCPBUGS-80492,OCPBUGS-80493,OCPBUGS-80494: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.75.1-sec.1 [release-4.19] operator-framework-olm#1310
- 9: [Release-4.19] OCPBUGS-80485,OCPBUGS-80484: Update grpc to v1.75.1-sec.1 to fix CVE-2026-33186 operator-framework-operator-controller#731
🌐 Web query:
grpc-go security patches "-sec" suffix version
💡 Result:
The gRPC-Go project does not officially use a "-sec" suffix for its standard security release versions [1][2][3]. Releases for gRPC-Go follow the Semantic Versioning 2.0.0 specification [1]. References to versions with a "-sec" suffix, such as "v1.71.3-sec.1" seen in some external contexts (e.g., downstream package management or specific enterprise distributions), originate from third-party distributors or downstream maintainers rather than the official grpc/grpc-go repository [4]. These downstream entities often apply custom security patches to older, officially unsupported versions and append a suffix to distinguish their modified builds from the official releases [4]. In the official gRPC-Go repository, security fixes are incorporated into standard patch or minor releases [5][1][3]. For example, the security fix for CVE-2026-33186 was released in the official version v1.79.3 [5][6][7]. When maintainers backport such fixes to older release branches (like v1.66.x) to support downstream users, they maintain the standard versioning format on the official branch, although downstream repackagers may then apply their own versioning conventions [4].
Citations:
- 1: https://github.com/grpc/grpc-go/blob/master/Documentation/versioning.md
- 2: Project Release Schedule grpc/grpc-go#8138
- 3: https://github.com/grpc/grpc-go/releases
- 4: Cherry pick fix for CVE-2026-33186 for 1.66.x (grpc-ui vuln.) grpc/grpc-go#9024
- 5: https://github.com/grpc/grpc-go/releases/tag/v1.79.3
- 6: https://nvd.nist.gov/vuln/detail/cve-2026-33186
- 7: https://cve.circl.lu/cve/CVE-2026-33186
Document the gRPC fork redirect and supply chain policy.
The redirect to github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 is maintained by OpenShift for security backports (specifically CVE-2026-33186, an authorization bypass via malformed:path headers) and is justified by Go version compatibility requirements with Go 1.22 used in specific OpenShift release branches. The "-sec.1" suffix indicates a security-patched backport.
However, add explicit documentation in the repository (e.g., SECURITY.md, go.mod comments, or CONTRIBUTING.md) explaining:
- Why the fork is used instead of upstream versions (Go toolchain stability for release branches)
- How security updates are evaluated and backported
- The process for upgrading to new upstream gRPC versions
This improves transparency and helps reviewers understand the supply chain decision without external research.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 228, The gRPC replace directive for google.golang.org/grpc
pointing to the openshift-sustaining fork lacks documentation explaining the
supply chain decision. Add explicit documentation (such as comments in the
go.mod file, or in a SECURITY.md or CONTRIBUTING.md file) that explains why the
fork is used instead of upstream versions (Go toolchain stability for specific
release branches), how security updates are evaluated and backported (including
the reasoning for CVE-2026-33186), and the process for upgrading to new upstream
gRPC versions. This will provide reviewers with transparency about the fork
usage without requiring external research.
Source: Coding guidelines
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@kunalmemane: This pull request references Jira Issue OCPBUGS-79856, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
e519167 to
fd44050
Compare
|
@sbiradar10: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gnufied, sbiradar10 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/label backport-risk-assessed |
|
/verified by CI |
|
@rh-akhatavk: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
verified
openshift-ci
Bot
added
the
backport-risk-assessed
96d5fbc
into
openshift:release-4.14
|
@sbiradar10: Jira Issue Verification Checks: Jira Issue OCPBUGS-79856 Jira Issue OCPBUGS-79856 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in release 4.14.0-0.nightly-2026-07-01-185210 |
8 participants
https://redhat.atlassian.net/browse/OCPBUGS-79856
Summary by CodeRabbit