[Project Darkstar] ROSAENG-63302: Remediate 2 Go stdlib CVEs in managed-cluster-validating-webhooks - #611
Conversation
…chain go1.26.5 Addresses CVE-2026-39822 (CVSS 7.5) and CVE-2026-42505 (CVSS 5.3). Adds Go toolchain directive go1.26.5 to go.mod. Ref: ROSAENG-63302 Project Darkstar — automated CVE remediation (contact: Kevin Seiter)
|
@kseiter-rh: This pull request references ROSAENG-63302 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
WalkthroughThe module configuration adds a Go 1.26.5 toolchain requirement while retaining the Go 1.26.0 module version. ChangesGo toolchain configuration
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: kseiter-rh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 5-6: Enforce Go 1.26.5 in the release and build scripts rather
than relying only on the go.mod toolchain suggestion. Add an explicit version
check that fails with a clear message when the active toolchain differs, and
ensure any production builder container uses golang:1.26.5.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f5ab928c-98ce-4cd8-924c-5719ce6aafa1
📒 Files selected for processing (1)
go.mod
| toolchain go1.26.5 | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
fd -HI -t f . | while IFS= read -r file; do
case "$file" in
*/go.mod|*/go.work|*/Dockerfile*|*/Makefile|*/.github/workflows/*|*.yaml|*.yml|*.sh)
rg -n -H -C 2 \
'GOTOOLCHAIN|go1\.26\.5|go version|setup-go|golang:|GOSUMDB|cosign|provenance|attest|sbom' \
"$file" || true
;;
esac
doneRepository: openshift/managed-cluster-validating-webhooks
Length of output: 6175
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'Repository files of interest:\n'
git ls-files | rg '(^go\.mod$|Dockerfile|\.github/workflows/|.*\.sh$|.*\.yaml$|hack/|build/)' | sed -n '1,200p'
printf '\nModule file:\n'
cat -n go.mod
printf '\nBuild/CI scripts mentioning go/build/tools:\n'
rg -n -H -C 2 'go( |\/)|build|test|make|GOTOOLCHAIN|go1\.|setup-go|golang:|Go:' \
go.mod hack build .github 2>/dev/null || true
printf '\nTekton SBOM/signing references:\n'
for f in .tekton/*.yaml; do
echo "--- $f"
rg -n -C 3 'show-sbom|sign|signing|cosign|attest|provenance|sbom|release|push' "$f" || true
doneRepository: openshift/managed-cluster-validating-webhooks
Length of output: 30952
🌐 Web query:
Go toolchain directive recommended minimum toolchain GOTOOLCHAIN local module file suggested
💡 Result:
In Go, the toolchain directive in a go.mod file and the GOTOOLCHAIN environment variable serve complementary roles in managing which Go toolchain version is used for a project [1][2]. Toolchain Directive in go.mod The toolchain directive is used to declare a suggested minimum Go toolchain version for a module or workspace [1][3]. It is distinct from the go directive, which specifies the minimum Go language version required for the code [2][4]. Syntax: toolchain go1.21.4 Usage: 1. When you run a Go command, the toolchain directive acts as a suggestion [3][5]. If your currently installed (default) Go toolchain is older than the version specified in the toolchain directive, the Go command will automatically download and use the suggested version [1][6]. 2. If the toolchain directive is omitted, the Go command treats the version specified in the go directive as the default suggested toolchain [1][6]. 3. The toolchain directive does not impose requirements on other modules; it primarily ensures that anyone working within that specific module uses at least the specified version [2]. GOTOOLCHAIN Environment Variable The GOTOOLCHAIN environment variable provides a way to override or control how the Go command selects a toolchain at runtime [1][4]. Common Settings: - GOTOOLCHAIN=auto (Default): Allows the Go command to automatically switch toolchains based on the go or toolchain directives in your go.mod file [1][6]. - GOTOOLCHAIN=local: Disables automatic downloads. The Go command will only use the bundled toolchain installed on your system [6]. - GOTOOLCHAIN= (e.g., GOTOOLCHAIN=go1.21.3): Forces the Go command to use the specified version, downloading it if it is not already available [6][7]. - GOTOOLCHAIN=+auto: Uses the specified version by default but still allows upgrading to newer versions if requested by the go.mod file [1][2]. Summary for Best Practice For most projects, you do not need to set GOTOOLCHAIN manually; leaving it at the default (auto) is recommended [1][6]. Use the toolchain directive in your go.mod file to ensure that all contributors are using a consistent, minimum version of the Go toolchain, which improves reproducibility and prevents issues caused by using outdated toolchains [2][5].
Citations:
- 1: https://go.dev/doc/toolchain
- 2: https://go.dev/blog/toolchain
- 3: https://go.dev/doc/modules/gomod-ref
- 4: https://go.googlesource.com/proposal/+/refs/heads/master/design/57001-gotoolchain.md
- 5: https://go.dev/ref/mod
- 6: https://alexbozhenko.github.io/posts/2024-12-19-understand-go-toolchain-directive-or-your-money-back/
- 7: https://hoelz.ro/blog/use-gotoolchain-to-run-older-versions-of-the-go-toolchain
🌐 Web query:
Go vulnerability database CVE-2026-39822 Go version fixed 1.26.5
💡 Result:
CVE-2026-39822 is a security vulnerability in the Go standard library (specifically the os package) that allows for a "Root escape" via symbolic links when a trailing slash is present in the path [1][2][3]. On Unix systems, the os.Root functionality improperly followed symlinks to locations outside of the intended root directory if the final path component was a symbolic link and the path included a trailing slash (e.g., root.Open("symlink/")) [1][2][4]. This allowed potential unauthorized access to files outside of the defined root [1][2]. This vulnerability was addressed and fixed in Go version 1.26.5, which was released on July 7, 2026 [5][6][7]. Affected versions include: - Versions prior to 1.25.12 [3][4] - Versions from 1.26.0-0 up to (but not including) 1.26.5 [3][4] - Versions from 1.27.0-0 up to (but not including) 1.27.0-rc.2 [3][4] Users are advised to upgrade to the latest patch release in their respective Go version lines (such as 1.26.5 or 1.25.12) to mitigate this issue [5].
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-4970
- 2: os: Root escape via symlink plus trailing slash (CVE-2026-39822) golang/go#79005
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-39822
- 4: https://www.cve.org/CVERecord?id=CVE-2026-39822
- 5: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
- 6: https://go.dev/dl/
- 7: https://go.dev/doc/devel/release
🌐 Web query:
Go vulnerability database CVE-2026-42505 Go version fixed 1.26.5
💡 Result:
CVE-2026-42505 is a security vulnerability in the Go standard library's crypto/tls package, where the implementation of Encrypted Client Hello (ECH) would leak pre-shared key (PSK) identities during a handshake [1][2][3]. This information disclosure allowed a passive network observer to de-anonymize the server's hostname, even when ECH was intended to protect it [4][3]. This vulnerability was addressed in the Go 1.26.5 and Go 1.25.12 releases, which were published on July 7, 2026 [5][6][3]. Affected versions include: - All versions prior to 1.25.12 [2][7] - Go 1.26.0 through 1.26.4 [2][7] - Go 1.27.0-0 through 1.27.0-rc.1 [2][7] To remediate this vulnerability, users should upgrade to Go 1.26.5 (or 1.25.12 if using the 1.25 series) [5][3]. Detailed information regarding the fix can be found in the Go issue tracker (issue #79282) and the official Go release notes [4][5][6].
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-5856
- 2: https://osv.dev/vulnerability/CVE-2026-42505
- 3: https://openwall.com/lists/oss-security/2026/07/08/10
- 4: crypto/tls: omit PSK in ECH outer client hello golang/go#79282
- 5: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
- 6: https://go.dev/doc/devel/release
- 7: https://nvd.nist.gov/vuln/detail/cve-2026-42505
Make the remediation pin enforce the patched toolchain.
toolchain go1.26.5 is a suggested toolchain and will not run in every build path. CI/scripts can disable automatic switching with GOTOOLCHAIN=local, and existing local/test paths do not enforce or log the Go version. Add that check to the release/build scripts, and keep the container golang: version at 1.26.5 if it is a production builder.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 5 - 6, Enforce Go 1.26.5 in the release and build
scripts rather than relying only on the go.mod toolchain suggestion. Add an
explicit version check that fails with a clear message when the active toolchain
differs, and ensure any production builder container uses golang:1.26.5.
Source: Path instructions
|
/retest |
|
@kseiter-rh: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
[Project Darkstar] ROSAENG-63302: Remediate CVEs in managed-cluster-validating-webhooks
Changes
toolchain go1.26.5to go.mod (fixes Go stdlib CVEs)Fixed — Go stdlib (2 CVEs)
No Fix Available
Note: Prior Darkstar PR #601 was closed unmerged — this PR supersedes it.
About Project Darkstar
Summary by CodeRabbit