chore(deps): update module google.golang.org/protobuf to v1.33.0 [security] (release-v0.18)

[redhat-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/protobuf	indirect	minor	v1.31.0 -> v1.33.0

---

Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON

CGA-2vgr-6mqh-4r48 / CGA-v9cm-f6x8-5vj7 / CVE-2024-24786 / GHSA-8r3f-844c-mc37 / GO-2024-2611

More information

Details

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-24786
• https://github.com/protocolbuffers/protobuf-go/commit/f01a588e5810b90996452eec4a28f22a0afae023
• https://github.com/protocolbuffers/protobuf-go
• https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.33.0
• https://go.dev/cl/569356
• https://lists.fedoraproject.org/archives/list/[email protected]/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU
• https://pkg.go.dev/vuln/GO-2024-2611
• https://security.netapp.com/advisory/ntap-20240517-0002
• http://www.openwall.com/lists/oss-security/2024/03/08/4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

CGA-2vgr-6mqh-4r48 / CGA-v9cm-f6x8-5vj7 / CVE-2024-24786 / GHSA-8r3f-844c-mc37 / GO-2024-2611

More information

Details

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Severity

Unknown

References

• https://go.dev/cl/569356

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

protocolbuffers/protobuf-go (google.golang.org/protobuf)

v1.33.0

Compare Source

This release contains one security fix:

• encoding/protojson: Unmarshal could enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set. Unmarshal now correctly returns an error when handling these inputs. This is CVE-2024-24786.

v1.32.0

Compare Source

Full Changelog: protocolbuffers/protobuf-go@v1.31.0...v1.32.0

This release contains commit protocolbuffers/protobuf-go@bfcd647, which fixes a denial of service vulnerability by preventing a stack overflow through a default maximum recursion limit. See https://github.com/golang/protobuf/issues/1583 and https://github.com/golang/protobuf/issues/1584 for details.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mhenriks for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubevirt-bot]

@redhat-renovate-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-hostpath-provisioner-sanity	7c721f6	link	true	/test pull-hostpath-provisioner-sanity
pull-hpp-unit-test	7c721f6	link	false	/test pull-hpp-unit-test
pull-hostpath-provisioner-e2e-k8s	7c721f6	link	true	/test pull-hostpath-provisioner-e2e-k8s
pull-hostpath-provisioner-k8s-e2e-storage	7c721f6	link	true	/test pull-hostpath-provisioner-k8s-e2e-storage
pull-hostpath-provisioner-e2e-k8s-ceph	7c721f6	link	true	/test pull-hostpath-provisioner-e2e-k8s-ceph

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.