Skip to content

fix(deps): bump toolchain to go1.24.9 for CVEs found by govulncheck [backport to release/service/v0.11] #2850

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 30, 2025
Merged

fix(deps): bump toolchain to go1.24.9 for CVEs found by govulncheck [backport to release/service/v0.11] #2850

merged 1 commit into from
Oct 30, 2025

Conversation

@opentdf-automation
Copy link
Contributor

@opentdf-automation opentdf-automation bot commented Oct 30, 2025

Description

Backport of #2849 to release/service/v0.11.

@opentdf-automation opentdf-automation bot requested review from a team as code owners October 30, 2025 00:23
@opentdf-automation opentdf-automation bot mentioned this pull request Oct 30, 2025
Merged
@opentdf-automation
fix(deps): bump toolchain to go1.24.9 for CVEs found by govulncheck (#…
be8295c 
…2849)

```

go env
Run go install golang.org/x/vuln/cmd/govulncheck@latest
Run govulncheck -C lib/ocrypto -format text ./...
=== Symbol Results ===

Vulnerability #1: GO-2025-4011
    Parsing DER payload can cause memory exhaustion in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2025-4011
  Standard library
    Found in: encoding/[email protected]
    Fixed in: encoding/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:471:37: ocrypto.GetECKeySize calls x509.ParsePKIXPublicKey, which calls asn1.Unmarshal

Vulnerability #2: GO-2025-4010
    Insufficient validation of bracketed IPv6 hostnames in net/url
  More info: https://pkg.go.dev/vuln/GO-2025-4010
  Standard library
    Found in: net/[email protected]
    Fixed in: net/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:318:37: ocrypto.ECPubKeyFromPem calls x509.ParseCertificate, which eventually calls url.Parse

Vulnerability #3: GO-2025-4009
    Quadratic complexity when parsing some invalid inputs in encoding/pem
  More info: https://pkg.go.dev/vuln/GO-2025-4009
  Standard library
    Found in: encoding/[email protected]
    Fixed in: encoding/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:466:24: ocrypto.GetECKeySize calls pem.Decode

Vulnerability #4: GO-2025-4007
    Quadratic complexity when checking name constraints in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2025-4007
  Standard library
    Found in: crypto/[email protected]
    Fixed in: crypto/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:433:53: ocrypto.ECPrivateKeyInPemFormat calls x509.MarshalPKCS8PrivateKey
Error:       #2: ec_key_pair.go:449:39: ocrypto.ECPublicKeyInPemFormat calls x509.MarshalPKIXPublicKey
Error:       #3: ec_key_pair.go:318:37: ocrypto.ECPubKeyFromPem calls x509.ParseCertificate
Error:       #4: asym_decryption.go:57:37: ocrypto.FromPrivatePEMWithSalt calls x509.ParseECPrivateKey
Error:       #5: asym_decryption.go:52:40: ocrypto.FromPrivatePEMWithSalt calls x509.ParsePKCS1PrivateKey
Error:       #6: ec_key_pair.go:352:40: ocrypto.ECPrivateKeyFromPem calls x509.ParsePKCS8PrivateKey
Error:       #7: ec_key_pair.go:471:37: ocrypto.GetECKeySize calls x509.ParsePKIXPublicKey

Your code is affected by 4 vulnerabilities from the Go standard library.
This scan also found 1 vulnerability in packages you import and 5
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
```

(cherry picked from commit 23f76c0)
@opentdf-automation opentdf-automation bot force-pushed the backport-2849-to-release/service/v0.11 branch from 0bc3b35 to be8295c Compare October 30, 2025 00:23
@github-actions github-actions bot added comp:sdk A software development kit, including library, for client applications and inter-service communicati comp:examples comp:lib:fixtures comp:lib:ocrypto size/s labels Oct 30, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Oct 30, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 193.248245ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 101.484222ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 365.41355ms
Throughput 273.66 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.206929261s
Average Latency 390.617783ms
Throughput 127.53 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.388470811s
Average Latency 273.222082ms
Throughput 182.56 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Oct 30, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 190.231756ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 106.898034ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 364.884359ms
Throughput 274.06 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.339126351s
Average Latency 391.8176ms
Throughput 127.10 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.321878598s
Average Latency 272.425607ms
Throughput 183.00 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Oct 30, 2025

X-Test Results

opentdfplatformEM22UT.dockerbuild
✅ js-v0.4.34
cukes-report
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-0bc3b357cf9d7790afee6166c3f959319dd4ed2f
✅ java-0bc3b357cf9d7790afee6166c3f959319dd4ed2f
✅ go-0bc3b357cf9d7790afee6166c3f959319dd4ed2f

@github-actions
Copy link
Contributor

github-actions bot commented Oct 30, 2025

X-Test Results

opentdfplatformRGKEH9.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2850
✅ java-pull-2850
✅ go-pull-2850

@jakedoublev jakedoublev merged commit 7abd272 into release/service/v0.11 Oct 30, 2025
34 checks passed
@jakedoublev jakedoublev deleted the backport-2849-to-release/service/v0.11 branch October 30, 2025 13:56
@opentdf-automation opentdf-automation bot mentioned this pull request Oct 30, 2025
Merged
dmihalcik-virtru pushed a commit that referenced this pull request Oct 30, 2025
@opentdf-automation
chore(release): release service 0.11.2 (#2856)
73a5ef4 
🤖 I have created a release *beep* *boop*
---


##
[0.11.2](service/v0.11.1...service/v0.11.2)
(2025-10-30)


### Bug Fixes

* **authz:** obligations should be logged to audit but not returned when
not entitled [backport to release/service/v0.11]
([#2855](#2855))
([ca67239](ca67239))
* **core:** Let default basic keymanager work again [backport to
release/service/v0.11]
([#2859](#2859))
([ba37f2a](ba37f2a))
* **deps:** bump toolchain to go1.24.9 for CVEs found by govulncheck
[backport to release/service/v0.11]
([#2850](#2850))
([7abd272](7abd272))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@strantalis strantalis strantalis approved these changes

@jakedoublev jakedoublev jakedoublev approved these changes

Assignees

No one assigned

Labels

comp:examples comp:lib:fixtures comp:lib:ocrypto comp:sdk A software development kit, including library, for client applications and inter-service communicati size/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@strantalis @jakedoublev