[Project Darkstar] ROSAENG-63302: Remediate 2 Go stdlib CVEs in managed-cluster-validating-webhooks - #611
Conversation
…chain go1.26.5 Addresses CVE-2026-39822 (CVSS 7.5) and CVE-2026-42505 (CVSS 5.3). Adds Go toolchain directive go1.26.5 to go.mod. Ref: ROSAENG-63302 Project Darkstar — automated CVE remediation (contact: Kevin Seiter)
|
@kseiter-rh: This pull request references ROSAENG-63302 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
WalkthroughThe module configuration adds a Go 1.26.5 toolchain requirement while retaining the Go 1.26.0 module version. ChangesGo toolchain configuration
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: kseiter-rh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 5-6: Enforce Go 1.26.5 in the release and build scripts rather
than relying only on the go.mod toolchain suggestion. Add an explicit version
check that fails with a clear message when the active toolchain differs, and
ensure any production builder container uses golang:1.26.5.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f5ab928c-98ce-4cd8-924c-5719ce6aafa1
📒 Files selected for processing (1)
go.mod
| toolchain go1.26.5 | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
fd -HI -t f . | while IFS= read -r file; do
case "$file" in
*/go.mod|*/go.work|*/Dockerfile*|*/Makefile|*/.github/workflows/*|*.yaml|*.yml|*.sh)
rg -n -H -C 2 \
'GOTOOLCHAIN|go1\.26\.5|go version|setup-go|golang:|GOSUMDB|cosign|provenance|attest|sbom' \
"$file" || true
;;
esac
doneRepository: openshift/managed-cluster-validating-webhooks
Length of output: 6175
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'Repository files of interest:\n'
git ls-files | rg '(^go\.mod$|Dockerfile|\.github/workflows/|.*\.sh$|.*\.yaml$|hack/|build/)' | sed -n '1,200p'
printf '\nModule file:\n'
cat -n go.mod
printf '\nBuild/CI scripts mentioning go/build/tools:\n'
rg -n -H -C 2 'go( |\/)|build|test|make|GOTOOLCHAIN|go1\.|setup-go|golang:|Go:' \
go.mod hack build .github 2>/dev/null || true
printf '\nTekton SBOM/signing references:\n'
for f in .tekton/*.yaml; do
echo "--- $f"
rg -n -C 3 'show-sbom|sign|signing|cosign|attest|provenance|sbom|release|push' "$f" || true
doneRepository: openshift/managed-cluster-validating-webhooks
Length of output: 30952
🌐 Web query:
Go toolchain directive recommended minimum toolchain GOTOOLCHAIN local module file suggested
💡 Result:
In Go, the toolchain directive in a go.mod file and the GOTOOLCHAIN environment variable serve complementary roles in managing which Go toolchain version is used for a project [1][2]. Toolchain Directive in go.mod The toolchain directive is used to declare a suggested minimum Go toolchain version for a module or workspace [1][3]. It is distinct from the go directive, which specifies the minimum Go language version required for the code [2][4]. Syntax: toolchain go1.21.4 Usage: 1. When you run a Go command, the toolchain directive acts as a suggestion [3][5]. If your currently installed (default) Go toolchain is older than the version specified in the toolchain directive, the Go command will automatically download and use the suggested version [1][6]. 2. If the toolchain directive is omitted, the Go command treats the version specified in the go directive as the default suggested toolchain [1][6]. 3. The toolchain directive does not impose requirements on other modules; it primarily ensures that anyone working within that specific module uses at least the specified version [2]. GOTOOLCHAIN Environment Variable The GOTOOLCHAIN environment variable provides a way to override or control how the Go command selects a toolchain at runtime [1][4]. Common Settings: - GOTOOLCHAIN=auto (Default): Allows the Go command to automatically switch toolchains based on the go or toolchain directives in your go.mod file [1][6]. - GOTOOLCHAIN=local: Disables automatic downloads. The Go command will only use the bundled toolchain installed on your system [6]. - GOTOOLCHAIN= (e.g., GOTOOLCHAIN=go1.21.3): Forces the Go command to use the specified version, downloading it if it is not already available [6][7]. - GOTOOLCHAIN=+auto: Uses the specified version by default but still allows upgrading to newer versions if requested by the go.mod file [1][2]. Summary for Best Practice For most projects, you do not need to set GOTOOLCHAIN manually; leaving it at the default (auto) is recommended [1][6]. Use the toolchain directive in your go.mod file to ensure that all contributors are using a consistent, minimum version of the Go toolchain, which improves reproducibility and prevents issues caused by using outdated toolchains [2][5].
Citations:
- 1: https://go.dev/doc/toolchain
- 2: https://go.dev/blog/toolchain
- 3: https://go.dev/doc/modules/gomod-ref
- 4: https://go.googlesource.com/proposal/+/refs/heads/master/design/57001-gotoolchain.md
- 5: https://go.dev/ref/mod
- 6: https://alexbozhenko.github.io/posts/2024-12-19-understand-go-toolchain-directive-or-your-money-back/
- 7: https://hoelz.ro/blog/use-gotoolchain-to-run-older-versions-of-the-go-toolchain
🌐 Web query:
Go vulnerability database CVE-2026-39822 Go version fixed 1.26.5
💡 Result:
CVE-2026-39822 is a security vulnerability in the Go standard library (specifically the os package) that allows for a "Root escape" via symbolic links when a trailing slash is present in the path [1][2][3]. On Unix systems, the os.Root functionality improperly followed symlinks to locations outside of the intended root directory if the final path component was a symbolic link and the path included a trailing slash (e.g., root.Open("symlink/")) [1][2][4]. This allowed potential unauthorized access to files outside of the defined root [1][2]. This vulnerability was addressed and fixed in Go version 1.26.5, which was released on July 7, 2026 [5][6][7]. Affected versions include: - Versions prior to 1.25.12 [3][4] - Versions from 1.26.0-0 up to (but not including) 1.26.5 [3][4] - Versions from 1.27.0-0 up to (but not including) 1.27.0-rc.2 [3][4] Users are advised to upgrade to the latest patch release in their respective Go version lines (such as 1.26.5 or 1.25.12) to mitigate this issue [5].
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-4970
- 2: os: Root escape via symlink plus trailing slash (CVE-2026-39822) golang/go#79005
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-39822
- 4: https://www.cve.org/CVERecord?id=CVE-2026-39822
- 5: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
- 6: https://go.dev/dl/
- 7: https://go.dev/doc/devel/release
🌐 Web query:
Go vulnerability database CVE-2026-42505 Go version fixed 1.26.5
💡 Result:
CVE-2026-42505 is a security vulnerability in the Go standard library's crypto/tls package, where the implementation of Encrypted Client Hello (ECH) would leak pre-shared key (PSK) identities during a handshake [1][2][3]. This information disclosure allowed a passive network observer to de-anonymize the server's hostname, even when ECH was intended to protect it [4][3]. This vulnerability was addressed in the Go 1.26.5 and Go 1.25.12 releases, which were published on July 7, 2026 [5][6][3]. Affected versions include: - All versions prior to 1.25.12 [2][7] - Go 1.26.0 through 1.26.4 [2][7] - Go 1.27.0-0 through 1.27.0-rc.1 [2][7] To remediate this vulnerability, users should upgrade to Go 1.26.5 (or 1.25.12 if using the 1.25 series) [5][3]. Detailed information regarding the fix can be found in the Go issue tracker (issue #79282) and the official Go release notes [4][5][6].
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-5856
- 2: https://osv.dev/vulnerability/CVE-2026-42505
- 3: https://openwall.com/lists/oss-security/2026/07/08/10
- 4: crypto/tls: omit PSK in ECH outer client hello golang/go#79282
- 5: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
- 6: https://go.dev/doc/devel/release
- 7: https://nvd.nist.gov/vuln/detail/cve-2026-42505
Make the remediation pin enforce the patched toolchain.
toolchain go1.26.5 is a suggested toolchain and will not run in every build path. CI/scripts can disable automatic switching with GOTOOLCHAIN=local, and existing local/test paths do not enforce or log the Go version. Add that check to the release/build scripts, and keep the container golang: version at 1.26.5 if it is a production builder.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 5 - 6, Enforce Go 1.26.5 in the release and build
scripts rather than relying only on the go.mod toolchain suggestion. Add an
explicit version check that fails with a clear message when the active toolchain
differs, and ensure any production builder container uses golang:1.26.5.
Source: Path instructions
2 participants
[Project Darkstar] ROSAENG-63302: Remediate CVEs in managed-cluster-validating-webhooks
Changes
toolchain go1.26.5to go.mod (fixes Go stdlib CVEs)Fixed — Go stdlib (2 CVEs)
No Fix Available
Note: Prior Darkstar PR #601 was closed unmerged — this PR supersedes it.
About Project Darkstar
Summary by CodeRabbit