Skip to content

fix(deps): backport grpc v1.83.1 and x/crypto v0.56.0 (CVE-2026-41178) - #615

Open
dbkreling wants to merge 2 commits into
openshift:osc-releasefrom
dbkreling:fix/CVE-2026-41178
Open

fix(deps): backport grpc v1.83.1 and x/crypto v0.56.0 (CVE-2026-41178)#615
dbkreling wants to merge 2 commits into
openshift:osc-releasefrom
dbkreling:fix/CVE-2026-41178

Conversation

@dbkreling

@dbkreling dbkreling commented Sep 2, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

Summary

Bumps go.opentelemetry.io/otel and related modules from v1.43.0 to v1.44.0 to resolve CVE-2026-41178.

Updates all three workspace modules:

  • src/cloud-api-adaptor/go.mod
  • src/cloud-providers/go.mod
  • src/peerpod-ctrl/go.mod

CVE: CVE-2026-41178
Vulnerable range: < v1.44.0
Fixed in: v1.44.0
Jira ticket: KATA-5829

This PR was created by the kata-bug-triage skill and supervised by Daniel Kreling.

@dbkreling
dbkreling force-pushed the fix/CVE-2026-41178 branch 2 times, most recently from 0f76eee to f85b8a4 Compare September 3, 2026 11:33
@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 3, 2026
@dbkreling
dbkreling changed the base branch from osc-release-v1.13 to osc-release September 3, 2026 11:33
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 3, 2026
@dbkreling

dbkreling commented Sep 3, 2026

Copy link
Copy Markdown
Author

/ok-to-test

@openshift-ci openshift-ci Bot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Sep 3, 2026
gkurz
gkurz requested changes Sep 3, 2026
View reviewed changes

@gkurz gkurz left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @dbkreling !

This should be fixed in upstream CAA and backported.

@gkurz

gkurz commented Sep 3, 2026

Copy link
Copy Markdown
Member

Hi @dbkreling !

This should be fixed in upstream CAA and backported.

It seems some other CVE leads to the same fix.

confidential-containers#3274 (review)

Worth checking it fully addresses CVE-2026-41178, cherry-pick it and call it a day @dbkreling.

@gkurz

gkurz commented Sep 4, 2026

Copy link
Copy Markdown
Member

/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 4, 2026
Daniel Kreling and others added 2 commits September 16, 2026 12:09
Daniel Kreling @claude @dbkreling
fix(deps): bump google.golang.org/grpc to v1.83.1
ae61450 
Backport of confidential-containers#3274, first commit
(upstream 2aefb8b). Recomputed against osc-release instead of
cherry-picked: osc-release lags upstream on grpc (v1.81.1 in
cloud-providers, v1.79.3 in webhook vs v1.82.1 upstream), so the go.sum
hunks do not transplant.

This commit pulls in the transitives of grpc v1.83.1: go.opentelemetry.io/otel,
metric, sdk and trace v1.43.0 -> v1.44.0, genproto api/rpc
-> v0.0.0-20260526163538-3dc84a4a5aaa, and cel.dev/expr v0.25.1 ->
v0.25.2 in webhook. The otel bump is the fix for CVE-2026-41178
(GHSA-5wrp-cwcj-q835), which is vulnerable at exactly v1.43.0.

Two lines differ from upstream because osc-release starts further back:
webhook also takes golang.org/x/oauth2 v0.34.0 -> v0.36.0 (upstream was
already there), and peerpod-ctrl gains an explicit
go.opentelemetry.io/otel/sdk v1.44.0 indirect entry.

Signed-off-by: Daniel Kreling <dkreling@redhat.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Daniel Kreling @claude @dbkreling
fix(deps): bump golang.org/x/crypto to v0.56.0
92d763d 
Backport of confidential-containers#3274, second
commit (upstream 4762361). Recomputed against osc-release rather than
cherry-picked: osc-release is on x/crypto v0.52.0 (cloud-providers) and
v0.53.0 (cloud-api-adaptor, peerpod-ctrl) and upstream is on v0.54.0 and
v0.55.0, so the go.sum hunks do not transplant. webhook is untouched,
matching upstream.

x/crypto v0.56.0 declares go 1.26.0, which raises the go directive in
the three modules from 1.25.12 to 1.26.0. The builders are already
ubi9/go-toolset:1.26.7 (Dockerfile.openshift, webhook/Dockerfile), and
upstream is on go 1.26.7, so this is within range.

The other x/* moves are transitive requirements of that set: net
v0.57.0, sync v0.22.0, sys v0.47.0, term v0.45.0, text v0.41.0, plus mod
v0.38.0 and tools v0.48.0 where they are already tracked.

Signed-off-by: Daniel Kreling <dkreling@redhat.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@dbkreling

dbkreling commented Sep 16, 2026

Copy link
Copy Markdown
Author

@gkurz I went with your suggestion — this PR now carries the #3274 backport instead of the otel-only bump.

Confirmed it fully addresses CVE-2026-41178: the otel 1.43.0 → 1.44.0 fix arrives as a consequence of the grpc v1.83.1 bump, and otel is vulnerable at exactly 1.43.0 with 1.44.0 the first patched release.

A literal cherry-pick won't apply — osc-release is behind upstream on both grpc and x/crypto, so every go.sum hunk conflicts. These proposed changes are the equivalent result computed on top of osc-release, split into the same two commits upstream used, and it lands us on the same versions they're on: grpc v1.83.1, x/crypto v0.56.0, otel v1.44.0, x/text v0.41.0, cel.dev/expr v0.25.2 and the genproto pair.

Three things differ from upstream's diff, all because we start further back:

  • webhook also picks up x/oauth2 v0.36.0,
  • peerpod-ctrl gains an explicit otel/sdk entry, and
  • the go directive moves 1.25.12 → 1.26.0 in three modules since x/crypto v0.56.0 requires it.

Our builders are already on go-toolset 1.26.7 and upstream is on go 1.26.7, so that last one is in range — the one thing worth a second opinion is peerpod-ctrl/Dockerfile, which pins a golang digest I haven't resolved and is not included in this PR.

All four modules verify, tidy clean and build clean.

/unhold when you're happy.

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 16, 2026
@dbkreling

dbkreling commented Sep 16, 2026

Copy link
Copy Markdown
Author

/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 16, 2026
@dbkreling dbkreling changed the title fix(deps): bump go.opentelemetry.io/otel to v1.44.0 for CVE-2026-41178 fix(deps): backport grpc v1.83.1 and x/crypto v0.56.0 (CVE-2026-41178) Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gkurz gkurz gkurz requested changes

Assignees

No one assigned

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dbkreling @gkurz