Skip to content

fix(deps): bump toolchain to go1.24.9 for CVEs found by govulncheck [backport to release/sdk/v0.10] #2872

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 4, 2025
Merged

fix(deps): bump toolchain to go1.24.9 for CVEs found by govulncheck [backport to release/sdk/v0.10] #2872

merged 1 commit into from
Nov 4, 2025

Conversation

@opentdf-automation
Copy link
Contributor

@opentdf-automation opentdf-automation bot commented Nov 3, 2025

Description

Backport of #2849 to release/sdk/v0.10.

@opentdf-automation opentdf-automation bot requested review from a team as code owners November 3, 2025 19:16
@opentdf-automation opentdf-automation bot mentioned this pull request Nov 3, 2025
Merged
@opentdf-automation
fix(deps): bump toolchain to go1.24.9 for CVEs found by govulncheck (#…
dd5ed5e 
…2849)

```

go env
Run go install golang.org/x/vuln/cmd/govulncheck@latest
Run govulncheck -C lib/ocrypto -format text ./...
=== Symbol Results ===

Vulnerability #1: GO-2025-4011
    Parsing DER payload can cause memory exhaustion in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2025-4011
  Standard library
    Found in: encoding/[email protected]
    Fixed in: encoding/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:471:37: ocrypto.GetECKeySize calls x509.ParsePKIXPublicKey, which calls asn1.Unmarshal

Vulnerability #2: GO-2025-4010
    Insufficient validation of bracketed IPv6 hostnames in net/url
  More info: https://pkg.go.dev/vuln/GO-2025-4010
  Standard library
    Found in: net/[email protected]
    Fixed in: net/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:318:37: ocrypto.ECPubKeyFromPem calls x509.ParseCertificate, which eventually calls url.Parse

Vulnerability #3: GO-2025-4009
    Quadratic complexity when parsing some invalid inputs in encoding/pem
  More info: https://pkg.go.dev/vuln/GO-2025-4009
  Standard library
    Found in: encoding/[email protected]
    Fixed in: encoding/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:466:24: ocrypto.GetECKeySize calls pem.Decode

Vulnerability #4: GO-2025-4007
    Quadratic complexity when checking name constraints in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2025-4007
  Standard library
    Found in: crypto/[email protected]
    Fixed in: crypto/[email protected]
    Example traces found:
Error:       #1: ec_key_pair.go:433:53: ocrypto.ECPrivateKeyInPemFormat calls x509.MarshalPKCS8PrivateKey
Error:       #2: ec_key_pair.go:449:39: ocrypto.ECPublicKeyInPemFormat calls x509.MarshalPKIXPublicKey
Error:       #3: ec_key_pair.go:318:37: ocrypto.ECPubKeyFromPem calls x509.ParseCertificate
Error:       #4: asym_decryption.go:57:37: ocrypto.FromPrivatePEMWithSalt calls x509.ParseECPrivateKey
Error:       #5: asym_decryption.go:52:40: ocrypto.FromPrivatePEMWithSalt calls x509.ParsePKCS1PrivateKey
Error:       #6: ec_key_pair.go:352:40: ocrypto.ECPrivateKeyFromPem calls x509.ParsePKCS8PrivateKey
Error:       #7: ec_key_pair.go:471:37: ocrypto.GetECKeySize calls x509.ParsePKIXPublicKey

Your code is affected by 4 vulnerabilities from the Go standard library.
This scan also found 1 vulnerability in packages you import and 5
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
```

(cherry picked from commit 23f76c0)
@opentdf-automation opentdf-automation bot force-pushed the backport-2849-to-release/sdk/v0.10 branch from 97190ca to dd5ed5e Compare November 3, 2025 19:16
@github-actions github-actions bot added comp:sdk A software development kit, including library, for client applications and inter-service communicati comp:examples comp:lib:fixtures comp:lib:ocrypto size/s labels Nov 3, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Nov 3, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 174.952166ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 101.434827ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 356.70867ms
Throughput 280.34 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 38.886907342s
Average Latency 386.365465ms
Throughput 128.58 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.277318077s
Average Latency 271.779262ms
Throughput 183.30 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 3, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 152.137221ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 83.527964ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 397.246931ms
Throughput 251.73 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.426440375s
Average Latency 402.931561ms
Throughput 123.68 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.982040686s
Average Latency 278.614277ms
Throughput 178.69 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 3, 2025

X-Test Failure Report

opentdfplatformX64OCS.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
❌ js-pull-2872
❌ java-pull-2872
❌ go-pull-2872

@github-actions
Copy link
Contributor

github-actions bot commented Nov 3, 2025

X-Test Failure Report

opentdfplatformRPIYW5.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
❌ js-97190ca99fcf2100e9d05837bf24dffe6448e5b6
❌ java-97190ca99fcf2100e9d05837bf24dffe6448e5b6
❌ go-97190ca99fcf2100e9d05837bf24dffe6448e5b6

@strantalis strantalis merged commit fbda5d1 into release/sdk/v0.10 Nov 4, 2025
27 of 34 checks passed
@strantalis strantalis deleted the backport-2849-to-release/sdk/v0.10 branch November 4, 2025 19:03
@opentdf-automation opentdf-automation bot mentioned this pull request Nov 4, 2025
Merged
strantalis pushed a commit that referenced this pull request Nov 4, 2025
@opentdf-automation
chore(release): release sdk 0.10.1 (#2876)
a926223 
🤖 I have created a release *beep* *boop*
---


##
[0.10.1](sdk/v0.10.0...sdk/v0.10.1)
(2025-11-04)


### Features

* **sdk:** Expose policy binding hash from Nano. [backport to
release/sdk/v0.10]
([#2869](#2869))
([556a0e2](556a0e2))


### Bug Fixes

* **deps:** bump toolchain to go1.24.9 for CVEs found by govulncheck
[backport to release/sdk/v0.10]
([#2872](#2872))
([fbda5d1](fbda5d1))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@strantalis strantalis strantalis approved these changes

Assignees

No one assigned

Labels

comp:examples comp:lib:fixtures comp:lib:ocrypto comp:sdk A software development kit, including library, for client applications and inter-service communicati size/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@strantalis