Bump go-restful/v3 to v3.10.2 to address PRISMA-2022-0227 by fredbalves86 · Pull Request #521 · openshift/operator-framework-olm

fredbalves86 · 2023-07-20T15:05:10Z

Bump go-restful/v3 to v3.10.2 to address PRISMA-2022-0227

Description:
github.com/emicklei/go-restful/v3 module prior to v3.10.0 is vulnerable to Authentication Bypass by Primary Weakness. There is an inconsistency in how go-restful parses URL paths. This inconsistency could lead to several security check bypass in a complex system.

Severity:
High

CVE:
PRISMA-2022-0227

openshift-ci · 2023-07-20T15:09:07Z

Hi @fredbalves86. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tmshort · 2023-07-20T17:02:01Z

/hold
Would like to get #510 in before this; as it updates go-restful/v3 to v3.10.1, and subsequently would make an update to v3.10.2 much easier.

tmshort · 2023-07-27T14:41:05Z

/unhold
#510 has been merged, so this requires a rebase, but it should actually be a trivial change.

openshift-ci · 2023-07-27T15:34:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fredbalves86
Once this PR has been reviewed and has the lgtm label, please assign awgreene for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tmshort · 2023-07-27T17:22:16Z

@fredbalves86:
This requires additional work.

Please git rebase this rather than merging from master
The use of go get is required, as it will update go.sum as well; editing go.mod is insufficient.
Run make vendor to update the vendor directory.

dinhxuanvu · 2023-07-27T18:28:04Z

Does this get fixed upstream?

tmshort · 2023-07-27T19:59:01Z

Does this get fixed upstream?

I don't believe so, I just downstreamed everything. It should probably be done upstream for the three source repos first.

dinhxuanvu · 2023-07-27T20:10:31Z

Does this get fixed upstream?

I don't believe so, I just downstreamed everything. It should probably be done upstream for the three source repos first.

I would expect this issue to be fixed upstream first then being downstreamed later. However, as long as someone remembers to fix it upstream then I don't care about the order.

fredbalves86 · 2023-07-31T09:23:51Z

Please git rebase this rather than merging from master
The use of go get is required, as it will update go.sum as well; editing go.mod is insufficient.
Run make vendor to update the vendor directory.

Done

tmshort · 2023-08-15T20:38:29Z

I bumped upstream:
operator-framework/api#290
operator-framework/operator-lifecycle-manager#3011
operator-framework/operator-registry#1136

dinhxuanvu · 2023-08-15T20:41:38Z

/ok-to-test

dinhxuanvu · 2023-08-15T20:45:58Z

Please git rebase this rather than merging from master
The use of go get is required, as it will update go.sum as well; editing go.mod is insufficient.
Run make vendor to update the vendor directory.

Done

The merge commit in the middle is still there. Please remove it. Thanks.

perdasilva · 2023-08-23T10:56:49Z

/retest

openshift-ci · 2023-08-23T11:04:09Z

@fredbalves86: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-olm-flaky	`76cfb73`	link	false	`/test e2e-gcp-olm-flaky`
ci/prow/unit-psm	`76cfb73`	link	true	`/test unit-psm`
ci/prow/e2e-gcp-console-olm	`76cfb73`	link	true	`/test e2e-gcp-console-olm`
ci/prow/e2e-upgrade	`76cfb73`	link	true	`/test e2e-upgrade`
ci/prow/images	`76cfb73`	link	true	`/test images`
ci/prow/e2e-gcp-ovn	`76cfb73`	link	true	`/test e2e-gcp-ovn`
ci/prow/verify	`76cfb73`	link	true	`/test verify`
ci/prow/e2e-gcp-olm	`76cfb73`	link	true	`/test e2e-gcp-olm`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

perdasilva · 2023-08-24T08:01:44Z

could you please run make verify and commit those changes? CI won't get green otherwise ^^

fredbalves86 · 2023-09-04T10:48:01Z

@perdasilva got some errors doing it. Anyone wants to close this one and open a new one with all the stuff needed?
Don't know what else to do with it.

tmshort · 2023-10-03T15:07:11Z

This was done as part of #567.

tmshort · 2023-10-03T15:07:29Z

I can't close this... but it should be closed.

tmshort · 2023-10-05T14:11:49Z

/close

openshift-ci · 2023-10-05T14:18:27Z

@tmshort: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Bump go-restful/v3 to v3.10.2

0a50079

openshift-ci Bot requested review from dinhxuanvu and kevinrizza July 20, 2023 15:08

openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 20, 2023

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 20, 2023

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 27, 2023

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 27, 2023

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 27, 2023

openshift-ci Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 15, 2023

fredbalves86 force-pushed the master branch 2 times, most recently from 91277ea to 0a50079 Compare August 17, 2023 11:43

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 17, 2023

fredbalves86 and others added 2 commits August 17, 2023 12:55

go get and make vendor

2cb46c3

Merge branch 'master' into master

76cfb73

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 17, 2023

openshift-ci Bot closed this Oct 5, 2023

Conversation

fredbalves86 commented Jul 20, 2023

Uh oh!

openshift-ci Bot commented Jul 20, 2023

Uh oh!

tmshort commented Jul 20, 2023

Uh oh!

tmshort commented Jul 27, 2023

Uh oh!

openshift-ci Bot commented Jul 27, 2023

Uh oh!

tmshort commented Jul 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dinhxuanvu commented Jul 27, 2023

Uh oh!

tmshort commented Jul 27, 2023

Uh oh!

dinhxuanvu commented Jul 27, 2023

Uh oh!

fredbalves86 commented Jul 31, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tmshort commented Aug 15, 2023

Uh oh!

dinhxuanvu commented Aug 15, 2023

Uh oh!

dinhxuanvu commented Aug 15, 2023

Uh oh!

perdasilva commented Aug 23, 2023

Uh oh!

openshift-ci Bot commented Aug 23, 2023

Uh oh!

perdasilva commented Aug 24, 2023

Uh oh!

fredbalves86 commented Sep 4, 2023

Uh oh!

tmshort commented Oct 3, 2023

Uh oh!

tmshort commented Oct 3, 2023

Uh oh!

tmshort commented Oct 5, 2023

Uh oh!

openshift-ci Bot commented Oct 5, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tmshort commented Jul 27, 2023 •

edited

Loading

fredbalves86 commented Jul 31, 2023 •

edited

Loading