OCPBUGS-80619: Bump google.golang.org/grpc to v1.79.3#506
Open
ocp-sustaining-admins wants to merge 1 commit intoopenshift:release-4.20from
Open
OCPBUGS-80619: Bump google.golang.org/grpc to v1.79.3#506ocp-sustaining-admins wants to merge 1 commit intoopenshift:release-4.20from
ocp-sustaining-admins wants to merge 1 commit intoopenshift:release-4.20from
Conversation
openshift-ci-robot
added
jira/severity-important
Contributor
|
@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-80619, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughUpdated Go toolchain from version 1.22.8 to 1.24.0 and upgraded multiple module dependencies across the project, including standard library modules (sys, crypto, net, sync, term, text), third-party libraries (logr, go-cmp, testify, go-jose), Google packages (grpc, protobuf, genproto), and OpenTelemetry modules. Added one new indirect dependency. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
bot
added
the
needs-ok-to-test
Contributor
|
Hi @ocp-sustaining-admins. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ocp-sustaining-admins The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ocp-sustaining-admins
force-pushed
the
release-4.20_CVE-2026-33186
branch
from
ca80309 to
1413dce
Compare
Member
|
/ok-to-test |
openshift-ci
bot
added
ok-to-test
Contributor
|
@ocp-sustaining-admins: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Member
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 165: The dependency go-jose/go-jose/v4 is vulnerable (CVE-2026-34986);
update the module version in go.mod from v4.1.3 to v4.1.4 to pick up the patch.
Ensure you run `go get github.com/go-jose/go-jose/v4@v4.1.4` (or update the
go.mod entry) and run `go mod tidy`/rebuild; this addresses the panic in
cipher.KeyUnwrap() that can be triggered via ParseEncrypted() and DecryptMulti()
in containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go when handling untrusted JWE
input.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3edc3ce0-1366-4ba9-a7a2-ed5624eb2030
⛔ Files ignored due to path filters (299)
go.sumis excluded by!**/*.sumvendor/github.com/go-jose/go-jose/v4/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/crypter.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/jwe.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/jwk.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/jws.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/shared.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/signing.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/go-jose/go-jose/v4/symmetric.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/go-logr/logr/.golangci.yamlis excluded by!vendor/**,!**/vendor/**vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/google/go-cmp/cmp/internal/function/func.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/google/go-cmp/cmp/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertion_compare.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertion_format.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertion_forward.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertion_order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertions.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/http_assertions.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_custom.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_default.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_fail.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/VERSIONING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/attr.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/resource.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/scope.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/limit.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer_provider.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.clomonitor.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.gitignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/SECURITY-INSIGHTS.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/hash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/xxhash/xxhash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/rawhelpers.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/get_main_pkgs.shis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/gen.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/handler.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/instruments.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/rawhelpers.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/asyncfloat64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/asyncint64.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/instrument.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/meter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/noop/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/renovate.jsonis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/requirements.txtis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/error_type.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/exception.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/schema.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/hex.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/number.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/resource.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/scope.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/status.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/traces.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/verify_readmes.shis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/argon2/argon2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/blake2b/blake2x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/blake2b/go125.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/chacha20/chacha_arm64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/cryptobyte/asn1.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/curve25519/curve25519.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_asm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_loong64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/openpgp/s2k/s2k.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/salsa20/salsa/hsalsa20.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/doc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/hashes.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/hashes_noasm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/keccakf_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/keccakf_amd64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/legacy_hash.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/legacy_keccakf.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/sha3_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/sha3_s390x.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/shake.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/sha3/shake_noasm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/agent/client.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/agent/keyring.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/agent/server.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/certs.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/cipher.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/client.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/client_auth.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/common.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/connection.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/doc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/handshake.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/kex.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/keys.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/mac.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/messages.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/mlkem.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/server.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/ssh_gss.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/streamlocal.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/tcpip.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/ssh/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/crypto/xts/xts.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/mod/modfile/read.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/mod/modfile/rule.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/mod/modfile/work.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/mod/module/module.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/mod/semver/semver.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/context/context.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/context/go17.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/context/go19.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/context/pre_go17.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/context/pre_go19.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/atom/table.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/escape.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/parse.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/render.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config_go124.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config_go125.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config_go126.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config_pre_go124.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/gotrack.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/timer.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/write.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc7540.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc9218.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/httpcommon/ascii.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/httpcommon/headermap.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/socks/socks.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/proxy/per_host.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/websocket/websocket.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/internal/doc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/internal/oauth2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/internal/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/internal/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sync/errgroup/go120.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sync/errgroup/pre_go120.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_arm64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_noinit.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_loong64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/cpu_x86.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/cpu/parse.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/plan9/pwd_go15_plan9.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/plan9/pwd_plan9.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/auxv.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/auxv_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/fdset.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ifreq_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkall.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_darwin.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_netbsd.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/registry/key.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/registry/value.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/registry/zsyscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
| github.com/felixge/httpsnoop v1.0.4 // indirect | ||
| github.com/fsnotify/fsnotify v1.8.0 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.0.5 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.1.3 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Confirm pinned version in go.mod =="
rg -n 'github.com/go-jose/go-jose/v4' go.mod
echo
echo "== Find imports/usages in repository =="
rg -n --type=go -C2 'go-jose/go-jose/v4|jose\.ParseEncrypted|\.Decrypt\('
echo
echo "== Check if go-jose is only transitive or also directly imported =="
rg -n --type=go -C1 'import .*go-jose/go-jose/v4|go-jose/go-jose/v4'Repository: openshift/builder
Length of output: 20101
🌐 Web query:
GHSA-78h2-9frx-2jm8 go-jose vulnerability JWE panic
💡 Result:
GHSA-78h2-9frx-2jm8 (CVE-2026-34986) is a denial-of-service (panic) bug in go-jose/go-jose during JWE decryption.
- Trigger: A crafted JWE where the protected header
algis a key-wrapping algorithm (ends withKW, exceptA128GCMKW,A192GCMKW,A256GCMKW) and theencrypted_keyfield is empty can cause a panic incipher.KeyUnwrap()(slice allocation with invalid length). This is reachable viaParseEncrypted*()followed byDecrypt(). [1] - Affected versions / fixed versions:
github.com/go-jose/go-jose/v4: < 4.1.4 affected; upgrade to 4.1.4. [1]github.com/go-jose/go-jose/v3: < 3.0.5 affected; upgrade to 3.0.5. [1]- Legacy
github.com/go-jose/go-jose(no/vN): versions <= 2.6.3 are listed as affected. [1]
- Workarounds/mitigations (if you can’t upgrade immediately):
- If you do not allow any
*KWkey management algorithms in thekeyAlgorithmslist passed toParseEncrypted*(), the vulnerable parse/decrypt path is not reachable. [1] - If you must support key wrapping, pre-validate that
encrypted_keyis non-empty (for compact JWE, ensure the segment between the first and second.is non-empty). [1]
- If you do not allow any
Sources: GitHub Advisory Database entry for GHSA-78h2-9frx-2jm8 / CVE-2026-34986. [1]
References
- [1] (github.com)
Citations:
🏁 Script executed:
#!/bin/bash
# Check the full context around ParseEncrypted call in ocicrypt
sed -n '65,85p' vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.goRepository: openshift/builder
Length of output: 1095
🏁 Script executed:
#!/bin/bash
# Check if Decrypt() is called after ParseEncrypted in the same function
sed -n '85,105p' vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.goRepository: openshift/builder
Length of output: 640
Upgrade go-jose/v4 from v4.1.3 to v4.1.4 to patch GHSA-78h2-9frx-2jm8 (CVE-2026-34986).
The vulnerable version is reachable: containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go explicitly accepts KW-based key algorithms and calls ParseEncrypted() followed by DecryptMulti() on untrusted JWE input from encrypted container layer metadata. A crafted JWE token with a key-wrapping algorithm and empty encrypted_key field triggers a panic in cipher.KeyUnwrap(), enabling DoS attacks on image decryption operations.
🧰 Tools
🪛 OSV Scanner (2.3.5)
[HIGH] 165-165: github.com/go-jose/go-jose/v4 4.1.3: Go JOSE Panics in JWE decryption
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 165, The dependency go-jose/go-jose/v4 is vulnerable
(CVE-2026-34986); update the module version in go.mod from v4.1.3 to v4.1.4 to
pick up the patch. Ensure you run `go get github.com/go-jose/go-jose/v4@v4.1.4`
(or update the go.mod entry) and run `go mod tidy`/rebuild; this addresses the
panic in cipher.KeyUnwrap() that can be triggered via ParseEncrypted() and
DecryptMulti() in containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go when
handling untrusted JWE input.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of an automated process.
The commands used to generate this PR were:
A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.