[Project Darkstar] ROSAENG-63319: Remediate 4 CVEs in splunk-forwarder-operator by kseiter-rh · Pull Request #468 · openshift/splunk-forwarder-operator

kseiter-rh · 2026-08-06T13:34:13Z

[Project Darkstar] ROSAENG-63319: Remediate CVEs in splunk-forwarder-operator

Changes

Add toolchain go1.25.12 to go.mod (fixes Go stdlib CVEs)
Bump UBI base image in build/Dockerfile: 9.8-1784705586 → 9.8-1785777232
Bump UBI base image in build/Dockerfile.olm-registry: 9.8-1784705586 → 9.8-1785777232

Fixed — Go stdlib (2 CVEs)

CVE-2026-39822 (stdlib, CVSS 7.5) — fix: Go 1.25.12+
CVE-2026-42505 (stdlib, CVSS 5.3) — fix: Go 1.25.12+

Fixed — Base Image (2 CVEs)

CVE-2026-54369 (libacl, CVSS 7.5) — fixed in UBI 9.8-1785777232
CVE-2026-5435 (glibc, CVSS 5.3) — fixed in UBI 9.8-1785777232

Not In This PR

golang.org/x/net, golang.org/x/text — deferred to MintMaker automation

No Fix Available

14 RPM-level CVEs (curl-minimal, glib2, libarchive, libxml2) — no upstream fix

FedRAMP SLA: Critical/Important CVEs must be remediated within 30 days of detection.

About Project Darkstar

Summary by CodeRabbit

Chores
- Updated the required Go toolchain version to 1.25.12 while retaining compatibility with Go 1.25.9.

…25.12 + bump UBI base image Addresses CVE-2026-39822, CVE-2026-42505 (Go stdlib) and CVE-2026-54369, CVE-2026-5435 (RPM-level via UBI base image update). UBI 9.8-1784705586 → 9.8-1785777232. Ref: ROSAENG-63319 Project Darkstar — automated CVE remediation (contact: Kevin Seiter)

openshift-ci-robot · 2026-08-06T13:34:18Z

@kseiter-rh: This pull request references ROSAENG-63319 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

[Project Darkstar] ROSAENG-63319: Remediate CVEs in splunk-forwarder-operator

Changes

Add toolchain go1.25.12 to go.mod (fixes Go stdlib CVEs)

Bump UBI base image in build/Dockerfile: 9.8-1784705586 → 9.8-1785777232

Bump UBI base image in build/Dockerfile.olm-registry: 9.8-1784705586 → 9.8-1785777232

Fixed — Go stdlib (2 CVEs)

CVE-2026-39822 (stdlib, CVSS 7.5) — fix: Go 1.25.12+

CVE-2026-42505 (stdlib, CVSS 5.3) — fix: Go 1.25.12+

Fixed — Base Image (2 CVEs)

CVE-2026-54369 (libacl, CVSS 7.5) — fixed in UBI 9.8-1785777232

CVE-2026-5435 (glibc, CVSS 5.3) — fixed in UBI 9.8-1785777232

Not In This PR

golang.org/x/net, golang.org/x/text — deferred to MintMaker automation

No Fix Available

14 RPM-level CVEs (curl-minimal, glib2, libarchive, libxml2) — no upstream fix

FedRAMP SLA: Critical/Important CVEs must be remediated within 30 days of detection.

About Project Darkstar

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-08-06T13:34:26Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2026-08-06T13:34:41Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2026-08-06T13:34:50Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f72d890-72d3-4717-a87c-a3c0e9c60b5a

📥 Commits

Reviewing files that changed from the base of the PR and between b498a17 and 3674e87.

⛔ Files ignored due to path filters (2)

build/Dockerfile is excluded by !build/**
build/Dockerfile.olm-registry is excluded by !build/**

📒 Files selected for processing (1)

go.mod

Walkthrough

The module configuration adds a Go 1.25.12 toolchain requirement and retains the module Go version at 1.25.9.

Changes

Go toolchain configuration

Layer / File(s)	Summary
Add Go toolchain directive `go.mod`	`go.mod` now requires the Go `1.25.12` toolchain while retaining Go version `1.25.9`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

openshift/splunk-forwarder-operator#436: Updates the go.mod toolchain directive.
openshift/splunk-forwarder-operator#452: Modifies go.mod Go and toolchain configuration.

Suggested reviewers: devnulljason

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	Kubernetes manifests permit privilege escalation and privileged containers; generated workloads also set privileged: true and runAsUser: 0.	Remove privileged and root settings, wildcard capabilities, and allowPrivilegeEscalation where possible. If required, document and narrowly scope the exception.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the project, issue, and primary change: remediation of four CVEs in splunk-forwarder-operator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only go.mod and two Dockerfiles. It changes no test files or Ginkgo test titles, so it introduces no dynamic test names.
Test Structure And Quality	✅ Passed	The PR contains no changes to test code. The check reviews Ginkgo test quality but is not applicable to this CVE remediation PR, which modifies only go.mod and Dockerfiles.
Microshift Test Compatibility	✅ Passed	The patch changes only two Dockerfiles and go.mod; it adds no Ginkgo tests or other test files to assess for MicroShift compatibility.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only two Dockerfiles and go.mod; it adds no Ginkgo e2e tests or test files that could make SNO assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch changes only go.mod and two Dockerfile base-image tags; it adds no deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only go.mod and Dockerfiles; this repository builds an operator and an osde2e Ginkgo test binary, not an openshift-tests OTE extension.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The change modifies only two Dockerfiles and go.mod; it adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The patch only adds toolchain go1.25.12 and updates two UBI tags; changed lines contain no weak-crypto APIs, custom crypto, or secret/token comparisons.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only a Go toolchain directive and two UBI image references; no logging code or sensitive data output is introduced.

✨ Finishing Touches 💡 2

⚔️ Resolve merge conflicts 💡

Resolve merge conflict in branch cve-fix/splunk-forwarder-operator-darkstar-2026-08-06

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-08-06T13:37:05Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kseiter-rh
Once this PR has been reviewed and has the lgtm label, please assign rafael-azevedo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 6, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 6, 2026

openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 6, 2026

Navigation Menu

Uh oh!

[Project Darkstar] ROSAENG-63319: Remediate 4 CVEs in splunk-forwarder-operator - #468

[Project Darkstar] ROSAENG-63319: Remediate 4 CVEs in splunk-forwarder-operator#468
kseiter-rh wants to merge 1 commit into
openshift:masterfrom
kseiter-rh:cve-fix/splunk-forwarder-operator-darkstar-2026-08-06

kseiter-rh commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-ci-robot commented Aug 6, 2026 •

edited by openshift-ci Bot

Loading

[Project Darkstar] ROSAENG-63319: Remediate CVEs in splunk-forwarder-operator

Changes

Fixed — Go stdlib (2 CVEs)

Fixed — Base Image (2 CVEs)

Not In This PR

No Fix Available

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

Pre-merge checks failed

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kseiter-rh commented Aug 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[Project Darkstar] ROSAENG-63319: Remediate CVEs in splunk-forwarder-operator

Changes

Fixed — Go stdlib (2 CVEs)

Fixed — Base Image (2 CVEs)

Not In This PR

No Fix Available

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Aug 6, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[Project Darkstar] ROSAENG-63319: Remediate CVEs in splunk-forwarder-operator

Changes

Fixed — Go stdlib (2 CVEs)

Fixed — Base Image (2 CVEs)

Not In This PR

No Fix Available

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Pre-merge checks failed

❌ Failed checks (1 error)

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kseiter-rh commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Aug 6, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading