Skip to content

[Project Darkstar] ROSAENG-63302: Remediate 2 Go stdlib CVEs in managed-cluster-validating-webhooks #611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kseiter-rh wants to merge 1 commit into from
Closed

[Project Darkstar] ROSAENG-63302: Remediate 2 Go stdlib CVEs in managed-cluster-validating-webhooks #611

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ module github.com/openshift/managed-cluster-validating-webhooks

go 1.26.0

toolchain go1.26.5

Comment on lines +5 to +6

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

fd -HI -t f . | while IFS= read -r file; do
  case "$file" in
    */go.mod|*/go.work|*/Dockerfile*|*/Makefile|*/.github/workflows/*|*.yaml|*.yml|*.sh)
      rg -n -H -C 2 \
        'GOTOOLCHAIN|go1\.26\.5|go version|setup-go|golang:|GOSUMDB|cosign|provenance|attest|sbom' \
        "$file" || true
      ;;
  esac
done

Repository: openshift/managed-cluster-validating-webhooks

Length of output: 6175

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf 'Repository files of interest:\n'
git ls-files | rg '(^go\.mod$|Dockerfile|\.github/workflows/|.*\.sh$|.*\.yaml$|hack/|build/)' | sed -n '1,200p'

printf '\nModule file:\n'
cat -n go.mod

printf '\nBuild/CI scripts mentioning go/build/tools:\n'
rg -n -H -C 2 'go( |\/)|build|test|make|GOTOOLCHAIN|go1\.|setup-go|golang:|Go:' \
  go.mod hack build .github 2>/dev/null || true

printf '\nTekton SBOM/signing references:\n'
for f in .tekton/*.yaml; do
  echo "--- $f"
  rg -n -C 3 'show-sbom|sign|signing|cosign|attest|provenance|sbom|release|push' "$f" || true
done

Repository: openshift/managed-cluster-validating-webhooks

Length of output: 30952

🌐 Web query:

Go toolchain directive recommended minimum toolchain GOTOOLCHAIN local module file suggested

💡 Result:

In Go, the toolchain directive in a go.mod file and the GOTOOLCHAIN environment variable serve complementary roles in managing which Go toolchain version is used for a project [1][2]. Toolchain Directive in go.mod The toolchain directive is used to declare a suggested minimum Go toolchain version for a module or workspace [1][3]. It is distinct from the go directive, which specifies the minimum Go language version required for the code [2][4]. Syntax: toolchain go1.21.4 Usage: 1. When you run a Go command, the toolchain directive acts as a suggestion [3][5]. If your currently installed (default) Go toolchain is older than the version specified in the toolchain directive, the Go command will automatically download and use the suggested version [1][6]. 2. If the toolchain directive is omitted, the Go command treats the version specified in the go directive as the default suggested toolchain [1][6]. 3. The toolchain directive does not impose requirements on other modules; it primarily ensures that anyone working within that specific module uses at least the specified version [2]. GOTOOLCHAIN Environment Variable The GOTOOLCHAIN environment variable provides a way to override or control how the Go command selects a toolchain at runtime [1][4]. Common Settings: - GOTOOLCHAIN=auto (Default): Allows the Go command to automatically switch toolchains based on the go or toolchain directives in your go.mod file [1][6]. - GOTOOLCHAIN=local: Disables automatic downloads. The Go command will only use the bundled toolchain installed on your system [6]. - GOTOOLCHAIN= (e.g., GOTOOLCHAIN=go1.21.3): Forces the Go command to use the specified version, downloading it if it is not already available [6][7]. - GOTOOLCHAIN=+auto: Uses the specified version by default but still allows upgrading to newer versions if requested by the go.mod file [1][2]. Summary for Best Practice For most projects, you do not need to set GOTOOLCHAIN manually; leaving it at the default (auto) is recommended [1][6]. Use the toolchain directive in your go.mod file to ensure that all contributors are using a consistent, minimum version of the Go toolchain, which improves reproducibility and prevents issues caused by using outdated toolchains [2][5].

Citations:

🌐 Web query:

Go vulnerability database CVE-2026-39822 Go version fixed 1.26.5

💡 Result:

CVE-2026-39822 is a security vulnerability in the Go standard library (specifically the os package) that allows for a "Root escape" via symbolic links when a trailing slash is present in the path [1][2][3]. On Unix systems, the os.Root functionality improperly followed symlinks to locations outside of the intended root directory if the final path component was a symbolic link and the path included a trailing slash (e.g., root.Open("symlink/")) [1][2][4]. This allowed potential unauthorized access to files outside of the defined root [1][2]. This vulnerability was addressed and fixed in Go version 1.26.5, which was released on July 7, 2026 [5][6][7]. Affected versions include: - Versions prior to 1.25.12 [3][4] - Versions from 1.26.0-0 up to (but not including) 1.26.5 [3][4] - Versions from 1.27.0-0 up to (but not including) 1.27.0-rc.2 [3][4] Users are advised to upgrade to the latest patch release in their respective Go version lines (such as 1.26.5 or 1.25.12) to mitigate this issue [5].

Citations:

🌐 Web query:

Go vulnerability database CVE-2026-42505 Go version fixed 1.26.5

💡 Result:

CVE-2026-42505 is a security vulnerability in the Go standard library's crypto/tls package, where the implementation of Encrypted Client Hello (ECH) would leak pre-shared key (PSK) identities during a handshake [1][2][3]. This information disclosure allowed a passive network observer to de-anonymize the server's hostname, even when ECH was intended to protect it [4][3]. This vulnerability was addressed in the Go 1.26.5 and Go 1.25.12 releases, which were published on July 7, 2026 [5][6][3]. Affected versions include: - All versions prior to 1.25.12 [2][7] - Go 1.26.0 through 1.26.4 [2][7] - Go 1.27.0-0 through 1.27.0-rc.1 [2][7] To remediate this vulnerability, users should upgrade to Go 1.26.5 (or 1.25.12 if using the 1.25 series) [5][3]. Detailed information regarding the fix can be found in the Go issue tracker (issue #79282) and the official Go release notes [4][5][6].

Citations:

Make the remediation pin enforce the patched toolchain.

toolchain go1.26.5 is a suggested toolchain and will not run in every build path. CI/scripts can disable automatic switching with GOTOOLCHAIN=local, and existing local/test paths do not enforce or log the Go version. Add that check to the release/build scripts, and keep the container golang: version at 1.26.5 if it is a production builder.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 5 - 6, Enforce Go 1.26.5 in the release and build
scripts rather than relying only on the go.mod toolchain suggestion. Add an
explicit version check that fails with a clear message when the active toolchain
differs, and ensure any production builder container uses golang:1.26.5.

Source: Path instructions

require (
github.com/evanphx/json-patch v5.9.11+incompatible
github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
Expand Down