Skip to content

Commit 87debda

Browse files
authored
[NPM] [Vulnerability] Resolve Ubuntu and Gobinary CVES in v1.6.42 Image (#4428)
* patch google.golang.org/grpc and stdlib cves in the go mod * fix ubuntu cves * added comment * update to go 1.24 to resolve errors * Added libgcrypt20=1.10.3-2ubuntu0.1 pin
1 parent 65dec22 commit 87debda

21 files changed

Lines changed: 123 additions & 106 deletions

.github/workflows/baseimages.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
- name: Set up Go
2222
uses: actions/setup-go@v5
2323
with:
24-
go-version: '1.23'
24+
go-version: '1.24'
2525
- name: Render Dockerfiles
2626
run: make dockerfiles
2727
- name: Fail if base images are outdated

.github/workflows/codeql.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
- name: Setup go
3636
uses: actions/setup-go@v5
3737
with:
38-
go-version: "1.23"
38+
go-version: "1.24"
3939
check-latest: true
4040
- name: Checkout repository
4141
uses: actions/checkout@v4

.github/workflows/crdgen.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
crdgen:
1515
strategy:
1616
matrix:
17-
go-version: ['1.22', '1.23']
17+
go-version: ['1.24']
1818
os: [ubuntu-latest]
1919
name: CRDs are Generated
2020
runs-on: ${{ matrix.os }}

.github/workflows/cyclonus-netpol-extended-nightly-test.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626

2727
- uses: actions/setup-go@v5
2828
with:
29-
go-version: "^1.23"
29+
go-version: "^1.24"
3030

3131
- name: Setup Kind
3232
uses: helm/kind-action@v1

.github/workflows/cyclonus-netpol-test.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333

3434
- uses: actions/setup-go@v5
3535
with:
36-
go-version: '^1.23'
36+
go-version: '^1.24'
3737

3838
- name: Setup Kind
3939
uses: helm/kind-action@v1

.github/workflows/golangci.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
strategy:
1616
fail-fast: false
1717
matrix:
18-
go-version: ['1.22.x', '1.23.x']
18+
go-version: ['1.24.x']
1919
os: [ubuntu-latest, windows-latest]
2020
name: Lint
2121
runs-on: ${{ matrix.os }}

cni/network/network.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -294,14 +294,14 @@ func (plugin *NetPlugin) getPodInfo(args string) (name, ns string, err error) {
294294
if len(k8sNamespace) == 0 {
295295
errMsg := "Pod Namespace not specified in CNI Args"
296296
logger.Error(errMsg)
297-
return "", "", plugin.Errorf(errMsg)
297+
return "", "", plugin.Errorf("%s", errMsg)
298298
}
299299

300300
k8sPodName := string(podCfg.K8S_POD_NAME)
301301
if len(k8sPodName) == 0 {
302302
errMsg := "Pod Name not specified in CNI Args"
303303
logger.Error(errMsg)
304-
return "", "", plugin.Errorf(errMsg)
304+
return "", "", plugin.Errorf("%s", errMsg)
305305
}
306306

307307
return k8sPodName, k8sNamespace, nil
@@ -495,14 +495,14 @@ func (plugin *NetPlugin) Add(args *cniSkel.CmdArgs) error {
495495
if len(k8sContainerID) == 0 {
496496
errMsg := "Container ID not specified in CNI Args"
497497
logger.Error(errMsg)
498-
return plugin.Errorf(errMsg)
498+
return plugin.Errorf("%s", errMsg)
499499
}
500500

501501
k8sIfName := args.IfName
502502
if len(k8sIfName) == 0 {
503503
errMsg := "Interfacename not specified in CNI Args"
504504
logger.Error(errMsg)
505-
return plugin.Errorf(errMsg)
505+
return plugin.Errorf("%s", errMsg)
506506
}
507507

508508
platformInit(nwCfg)
@@ -565,7 +565,7 @@ func (plugin *NetPlugin) Add(args *cniSkel.CmdArgs) error {
565565
errMsg := fmt.Sprintf("received multiple NC results %+v from CNS while dualnic feature is not supported", ipamAddResult.interfaceInfo)
566566
logger.Error("received multiple NC results from CNS while dualnic feature is not supported",
567567
zap.Any("results", ipamAddResult.interfaceInfo))
568-
return plugin.Errorf(errMsg)
568+
return plugin.Errorf("%s", errMsg)
569569
}
570570
} else {
571571
// when nwcfg.multitenancy (use multitenancy flag for swift v1 only) is false
@@ -842,7 +842,7 @@ func (plugin *NetPlugin) createEpInfo(opt *createEpInfoOpt) (*network.EndpointIn
842842
epPolicies, err := getPoliciesFromRuntimeCfg(opt.nwCfg, opt.ipamAddResult.ipv6Enabled) // not specific to delegated or infra
843843
if err != nil {
844844
logger.Error("failed to get policies from runtime configurations", zap.Error(err))
845-
return nil, plugin.Errorf(err.Error())
845+
return nil, plugin.Errorf("%s", err.Error())
846846
}
847847
endpointInfo.EndpointPolicies = append(endpointInfo.EndpointPolicies, epPolicies...)
848848

@@ -1311,14 +1311,14 @@ func (plugin *NetPlugin) Update(args *cniSkel.CmdArgs) error {
13111311
if len(k8sNamespace) == 0 {
13121312
errMsg := "Required parameter Pod Namespace not specified in CNI Args during UPDATE"
13131313
logger.Error(errMsg)
1314-
return plugin.Errorf(errMsg)
1314+
return plugin.Errorf("%s", errMsg)
13151315
}
13161316

13171317
k8sPodName := string(podCfg.K8S_POD_NAME)
13181318
if len(k8sPodName) == 0 {
13191319
errMsg := "Required parameter Pod Name not specified in CNI Args during UPDATE"
13201320
logger.Error(errMsg)
1321-
return plugin.Errorf(errMsg)
1321+
return plugin.Errorf("%s", errMsg)
13221322
}
13231323

13241324
// Initialize values from network config.
@@ -1328,7 +1328,7 @@ func (plugin *NetPlugin) Update(args *cniSkel.CmdArgs) error {
13281328
if _, err = plugin.nm.GetNetworkInfo(networkID); err != nil {
13291329
errMsg := fmt.Sprintf("Failed to query network during CNI UPDATE: %v", err)
13301330
logger.Error(errMsg)
1331-
return plugin.Errorf(errMsg)
1331+
return plugin.Errorf("%s", errMsg)
13321332
}
13331333

13341334
// Query the existing endpoint since this is an update.
@@ -1355,21 +1355,21 @@ func (plugin *NetPlugin) Update(args *cniSkel.CmdArgs) error {
13551355
if orchestratorContext, err = json.Marshal(podInfo); err != nil {
13561356
logger.Error("Marshalling KubernetesPodInfo failed",
13571357
zap.Error(err))
1358-
return plugin.Errorf(err.Error())
1358+
return plugin.Errorf("%s", err.Error())
13591359
}
13601360

13611361
cnsclient, err := cnscli.New(nwCfg.CNSUrl, defaultRequestTimeout)
13621362
if err != nil {
13631363
logger.Error("failed to initialized cns client",
13641364
zap.String("url", nwCfg.CNSUrl),
13651365
zap.String("error", err.Error()))
1366-
return plugin.Errorf(err.Error())
1366+
return plugin.Errorf("%s", err.Error())
13671367
}
13681368

13691369
if targetNetworkConfig, err = cnsclient.GetNetworkContainer(context.TODO(), orchestratorContext); err != nil {
13701370
logger.Info("GetNetworkContainer failed",
13711371
zap.Error(err))
1372-
return plugin.Errorf(err.Error())
1372+
return plugin.Errorf("%s", err.Error())
13731373
}
13741374

13751375
logger.Info("Network config received from cns",

cns/service/main.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1034,9 +1034,9 @@ func main() {
10341034

10351035
var localServerURL string
10361036
if config.Server.Port != "" {
1037-
localServerURL = fmt.Sprintf(defaultLocalServerIP + ":" + config.Server.Port)
1037+
localServerURL = defaultLocalServerIP + ":" + config.Server.Port
10381038
} else {
1039-
localServerURL = fmt.Sprintf(defaultLocalServerIP + ":" + defaultLocalServerPort)
1039+
localServerURL = defaultLocalServerIP + ":" + defaultLocalServerPort
10401040
}
10411041

10421042
httpLocalRestService := restserverv2.New(httpRemoteRestService)

go.mod

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/Azure/azure-container-networking
22

3-
go 1.23.2
3+
go 1.24.0
44

55
require (
66
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2
@@ -33,13 +33,13 @@ require (
3333
github.com/spf13/cobra v1.9.1
3434
github.com/spf13/pflag v1.0.7
3535
github.com/spf13/viper v1.20.1
36-
github.com/stretchr/testify v1.10.0
36+
github.com/stretchr/testify v1.11.1
3737
go.uber.org/zap v1.27.0
3838
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
39-
golang.org/x/sys v0.35.0
40-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
41-
google.golang.org/grpc v1.74.2
42-
google.golang.org/protobuf v1.36.6
39+
golang.org/x/sys v0.39.0
40+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
41+
google.golang.org/grpc v1.79.3
42+
google.golang.org/protobuf v1.36.10
4343
gopkg.in/natefinch/lumberjack.v2 v2.2.1
4444
k8s.io/api v0.30.14
4545
k8s.io/apiextensions-apiserver v0.30.1
@@ -101,11 +101,11 @@ require (
101101
github.com/vishvananda/netns v0.0.5
102102
go.opencensus.io v0.24.0 // indirect
103103
go.uber.org/multierr v1.11.0 // indirect
104-
golang.org/x/crypto v0.40.0
105-
golang.org/x/net v0.42.0
106-
golang.org/x/oauth2 v0.30.0 // indirect
107-
golang.org/x/term v0.33.0 // indirect
108-
golang.org/x/text v0.27.0 // indirect
104+
golang.org/x/crypto v0.46.0
105+
golang.org/x/net v0.48.0
106+
golang.org/x/oauth2 v0.34.0 // indirect
107+
golang.org/x/term v0.38.0 // indirect
108+
golang.org/x/text v0.32.0 // indirect
109109
golang.org/x/time v0.12.0
110110
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
111111
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
@@ -128,15 +128,15 @@ require (
128128
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
129129
github.com/cilium/cilium v1.15.15
130130
github.com/jsternberg/zap-logfmt v1.3.0
131-
golang.org/x/sync v0.16.0
131+
golang.org/x/sync v0.19.0
132132
gotest.tools/v3 v3.5.2
133133
k8s.io/kubectl v0.28.5
134134
k8s.io/kubernetes v1.30.14
135135
sigs.k8s.io/yaml v1.6.0
136136
)
137137

138138
require (
139-
cloud.google.com/go/compute/metadata v0.7.0 // indirect
139+
cloud.google.com/go/compute/metadata v0.9.0 // indirect
140140
github.com/JeffAshton/win_pdh v0.0.0-20161109143554-76bb4ee9f0ab // indirect
141141
github.com/NYTimes/gziphandler v1.1.1 // indirect
142142
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
@@ -197,7 +197,7 @@ require (
197197
github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
198198
github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
199199
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
200-
github.com/rogpeppe/go-internal v1.13.1 // indirect
200+
github.com/rogpeppe/go-internal v1.14.1 // indirect
201201
github.com/sasha-s/go-deadlock v0.3.1 // indirect
202202
github.com/seccomp/libseccomp-golang v0.10.0 // indirect
203203
github.com/shirou/gopsutil/v3 v3.23.5 // indirect
@@ -210,21 +210,21 @@ require (
210210
go.etcd.io/etcd/client/pkg/v3 v3.5.11 // indirect
211211
go.etcd.io/etcd/client/v3 v3.5.11 // indirect
212212
go.mongodb.org/mongo-driver v1.13.1 // indirect
213-
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
213+
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
214214
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.42.0 // indirect
215215
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
216216
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
217-
go.opentelemetry.io/otel v1.36.0 // indirect
217+
go.opentelemetry.io/otel v1.39.0 // indirect
218218
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 // indirect
219219
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 // indirect
220-
go.opentelemetry.io/otel/metric v1.36.0 // indirect
221-
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
222-
go.opentelemetry.io/otel/trace v1.36.0 // indirect
220+
go.opentelemetry.io/otel/metric v1.39.0 // indirect
221+
go.opentelemetry.io/otel/sdk v1.39.0 // indirect
222+
go.opentelemetry.io/otel/trace v1.39.0 // indirect
223223
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
224224
go.uber.org/dig v1.17.1 // indirect
225225
go.yaml.in/yaml/v2 v2.4.2 // indirect
226226
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
227-
google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
227+
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
228228
k8s.io/apiserver v0.30.14 // indirect
229229
k8s.io/cloud-provider v0.30.7 // indirect
230230
k8s.io/component-base v0.30.14 // indirect

0 commit comments

Comments
 (0)