OCPBUGS-6296: Address CVE-2022-41717 by alebedev87 · Pull Request #87 · openshift/coredns

alebedev87 · 2023-01-25T23:11:34Z

CVE-2022-41717

openshift-ci-robot · 2023-01-25T23:11:42Z

@alebedev87: This pull request references Jira Issue OCPBUGS-6296, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.13.0) matches configured target version for branch (4.13.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-01-25T23:11:44Z

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: lihongan.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@alebedev87: This pull request references Jira Issue OCPBUGS-6296, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)

bug target version (4.13.0) matches configured target version for branch (4.13.0)

bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-01-25T23:12:37Z

@alebedev87: This pull request references Jira Issue OCPBUGS-6296, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.13.0) matches configured target version for branch (4.13.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

Details

In response to this:

CVE-2022-41717

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-01-25T23:12:40Z

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: lihongan.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@alebedev87: This pull request references Jira Issue OCPBUGS-6296, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)

bug target version (4.13.0) matches configured target version for branch (4.13.0)

bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

In response to this:

CVE-2022-41717

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2023-01-26T16:43:30Z

/test images

alebedev87 · 2023-01-26T22:02:50Z

PR to fix the job names: openshift/release#35752

alebedev87 · 2023-01-26T22:10:00Z

/test images

alebedev87 · 2023-01-27T14:46:47Z

/test e2e-gcp-serial

alebedev87 · 2023-01-27T22:15:54Z

/test e2e-gcp-serial

alebedev87 · 2023-01-30T08:46:00Z

/test e2e-gcp-serial

alebedev87 · 2023-01-31T16:41:14Z

/test e2e-gcp-serial

alebedev87 · 2023-01-31T17:02:41Z

Discussion on the disruption test failures: https://redhat-internal.slack.com/archives/CBWMXQJKD/p1675177679304379.
Not many paths forwards, retrying for now...

alebedev87 · 2023-02-03T14:46:36Z

/test e2e-gcp-serial

To be dropped if golang.org/x/net upstream is >= v0.5.0.

openshift-ci · 2023-02-22T11:53:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from alebedev87. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

alebedev87 · 2023-02-22T15:39:34Z

/retest-required

alebedev87 · 2023-02-23T10:39:00Z

We currently do not have sufficient m6a.xlarge capacity in the Availability Zone you requested (us-east-1d)

/test e2e-aws-upgrade

alebedev87 · 2023-02-28T17:06:46Z

/test e2e-gcp-serial

alebedev87 · 2023-03-01T16:19:06Z

/test e2e-gcp-serial

melvinjoseph86 · 2023-03-03T06:49:27Z

/retest

melvinjoseph86 · 2023-03-03T06:53:57Z

Verifying using pre-merge image.
oc NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.13.0-0.ci.test-2023-03-03-051147-ci-ln-7qvj5i2-latest True False 60m Cluster version is 4.13.0-0.ci.test-2023-03-03-051147-ci-ln-7qvj5i2-latest

melvinjoseph@mjoseph-mac Downloads % oc get po -n openshift-dns
NAME READY STATUS RESTARTS AGE
dns-default-74qnf 2/2 Running 0 3m31s
dns-default-8jkk9 2/2 Running 0 73m
dns-default-k87pw 2/2 Running 0 69m
dns-default-kq2zr 2/2 Running 0 73m
dns-default-rhvls 2/2 Running 0 69m
dns-default-zmtw6 2/2 Running 0 73m
node-resolver-64chj 1/1 Running 0 73m
node-resolver-f888d 1/1 Running 0 69m
node-resolver-fw2fh 1/1 Running 0 73m
node-resolver-jqxtd 1/1 Running 0 69m
node-resolver-q7vl8 1/1 Running 0 73m
node-resolver-z7m2l 1/1 Running 0 4m14s

melvinjoseph@mjoseph-mac Downloads % oc rsync -n openshift-dns dns-default-74qnf:/usr/bin/coredns .
receiving file list ... done
coredns

sent 38 bytes received 72817404 bytes 2240536.68 bytes/sec
total size is 72799544 speedup is 1.00
Defaulted container "dns" out of: dns, kube-rbac-proxy
melvinjoseph@mjoseph-mac Downloads %
melvinjoseph@mjoseph-mac Downloads % strings ./coredns >> forbug.txt

melvinjoseph@mjoseph-mac Downloads % grep -B1 "1.19.4" forbug.txt
+mG|
go1.19.4

Go buildinf:
go1.19.4
melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.5.0" forbug.txt
github.com/openzipkin-contrib/zipkin-go-opentracing
v0.5.0

golang.org/x/sys
v0.5.0
golang.org/x/term
v0.5.0

github.com/openzipkin-contrib/zipkin-go-opentracing
v0.5.0

golang.org/x/sys
v0.5.0
golang.org/x/term
v0.5.0
melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.7.0" forbug.txt
golang.org/x/net
v0.7.0

golang.org/x/text
v0.7.0

golang.org/x/net
v0.7.0

golang.org/x/text
v0.7.0

Hence marking a verified

melvinjoseph86 · 2023-03-03T06:54:03Z

/label qe-approved

alebedev87 · 2023-03-10T13:27:43Z

/test e2e-gcp-serial

melvinjoseph86 · 2023-03-15T04:34:54Z

/retest-required

alebedev87 · 2023-03-17T13:45:57Z

/test e2e-gcp-serial

openshift-ci · 2023-03-31T16:33:55Z

@alebedev87: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-serial	`67f89ff`	link	true	`/test e2e-gcp-serial`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

gcs278 · 2023-04-03T13:35:06Z

CI is fixed.
/retest-required

gcs278 · 2023-04-04T13:38:30Z

According to the CVE, it's x/net < 0.4.0 that is affected.

I think the CVE is already satisfied without the updates, right?

I don't know how I overlooked that. Yes, it's <0.4.0, have to close this PR.

Update: the rebase PR which was created after this one bumped the new version of x/net. So, initially the PR was doing the right thing but the rebase PR got merged first.

alebedev87 · 2023-04-04T15:21:54Z

Current x/net version is v0.4.0 which is unaffected by CVE2022-41717.

openshift-ci-robot · 2023-04-04T15:22:02Z

@alebedev87: This pull request references Jira Issue OCPBUGS-6296. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

Details

In response to this:

CVE-2022-41717

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

…valid_mz fix: Ignore managed zone missing errors on deletion

openshift-ci Bot requested review from gcs278 and knobunc January 25, 2023 23:12

UPSTREAM: <carry>: openshift: address CVE-2022-41717

67f89ff

To be dropped if golang.org/x/net upstream is >= v0.5.0.

alebedev87 force-pushed the x-net-http2-cve-2022-41717 branch from e45f62a to 67f89ff Compare February 22, 2023 11:53

openshift-ci Bot added the qe-approved Signifies that QE has signed off on this PR label Mar 3, 2023

gcs278 reviewed Apr 4, 2023

View reviewed changes

alebedev87 closed this Apr 4, 2023

jjkiely pushed a commit to Kuadrant/coredns that referenced this pull request Sep 24, 2025

Merge pull request openshift#87 from mikenairn/fix_record_deletion_in…

97f8992

…valid_mz fix: Ignore managed zone missing errors on deletion

Conversation

alebedev87 commented Jan 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jan 25, 2023

Uh oh!

openshift-ci Bot commented Jan 25, 2023

Uh oh!

openshift-ci-robot commented Jan 25, 2023

Uh oh!

openshift-ci Bot commented Jan 25, 2023

Uh oh!

alebedev87 commented Jan 26, 2023

Uh oh!

alebedev87 commented Jan 26, 2023

Uh oh!

alebedev87 commented Jan 26, 2023

Uh oh!

alebedev87 commented Jan 27, 2023

Uh oh!

alebedev87 commented Jan 27, 2023

Uh oh!

alebedev87 commented Jan 30, 2023

Uh oh!

alebedev87 commented Jan 31, 2023

Uh oh!

alebedev87 commented Jan 31, 2023

Uh oh!

alebedev87 commented Feb 3, 2023

Uh oh!

openshift-ci Bot commented Feb 22, 2023

Uh oh!

alebedev87 commented Feb 22, 2023

Uh oh!

alebedev87 commented Feb 23, 2023

Uh oh!

alebedev87 commented Feb 28, 2023

Uh oh!

alebedev87 commented Mar 1, 2023

Uh oh!

melvinjoseph86 commented Mar 3, 2023

Uh oh!

melvinjoseph86 commented Mar 3, 2023

melvinjoseph@mjoseph-mac Downloads % grep -B1 "1.19.4" forbug.txt +mG| go1.19.4

Go buildinf: go1.19.4 melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.5.0" forbug.txt github.com/openzipkin-contrib/zipkin-go-opentracing v0.5.0

golang.org/x/sys v0.5.0 golang.org/x/term v0.5.0

github.com/openzipkin-contrib/zipkin-go-opentracing v0.5.0

golang.org/x/sys v0.5.0 golang.org/x/term v0.5.0 melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.7.0" forbug.txt golang.org/x/net v0.7.0

golang.org/x/text v0.7.0

golang.org/x/net v0.7.0

Uh oh!

melvinjoseph86 commented Mar 3, 2023

Uh oh!

alebedev87 commented Mar 10, 2023

Uh oh!

melvinjoseph86 commented Mar 15, 2023

Uh oh!

alebedev87 commented Mar 17, 2023

Uh oh!

openshift-ci Bot commented Mar 31, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gcs278 commented Apr 3, 2023

Uh oh!

gcs278 Apr 4, 2023

Choose a reason for hiding this comment

Uh oh!

alebedev87 Apr 4, 2023

Choose a reason for hiding this comment

Uh oh!

alebedev87 Apr 4, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alebedev87 commented Apr 4, 2023

Uh oh!

openshift-ci-robot commented Apr 4, 2023

Uh oh!

Reviewers

Assignees

alebedev87 commented Jan 25, 2023 •

edited

Loading

melvinjoseph@mjoseph-mac Downloads % grep -B1 "1.19.4" forbug.txt
+mG|
go1.19.4

Go buildinf:
go1.19.4
melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.5.0" forbug.txt
github.com/openzipkin-contrib/zipkin-go-opentracing
v0.5.0

golang.org/x/sys
v0.5.0
golang.org/x/term
v0.5.0

github.com/openzipkin-contrib/zipkin-go-opentracing
v0.5.0

golang.org/x/sys
v0.5.0
golang.org/x/term
v0.5.0
melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.7.0" forbug.txt
golang.org/x/net
v0.7.0

golang.org/x/text
v0.7.0

golang.org/x/net
v0.7.0

openshift-ci Bot commented Mar 31, 2023 •

edited

Loading

alebedev87 Apr 4, 2023 •

edited

Loading