[v4.4.1-rhel] CVE-2025-47913 x/crypto to v0.43.0 by TomSweeneyRedHat · Pull Request #28092 · podman-container-tools/podman

TomSweeneyRedHat · 2026-02-13T21:33:52Z

Bump golang.org/x/crypto to v0.43.0 to fix CVE-2025-47913. Note: This change has bumped Go requirement to v1.24 and I have removed the old replacement to the private crypto repository.

Fixes: https://issues.redhat.com/browse/OCPBUGS-67036, https://issues.redhat.com/browse/OCPBUGS-67053,
https://issues.redhat.com/browse/OCPBUGS-67070,
https://issues.redhat.com/browse/OCPBUGS-67090,
https://issues.redhat.com/browse/RHEL-134783,
https://issues.redhat.com/browse/RHEL-134787

NOTE: Shortly before merging, it was discovered that 3 commits need to be added to handle volume bind mounts appropriately with the latest version of runc. That was done in this PR: #28450, and the associated Jira cards in this PR will not be closed until that PR is merged.

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

None

TomSweeneyRedHat · 2026-02-13T21:34:35Z

@cevich and @dashea PTAL

Bump Fedora to v42 to get the necessary version of Go for this change. Signed-off-by: Tom Sweeney <tomsweney@redhat.com>

Bump golang.org/x/crypto to v0.43.0 to fix CVE-2025-47913. Note: This change has bumped Go requirement to v1.24 and I have removed the old replacement to the private crypto repository. Fixes: https://issues.redhat.com/browse/OCPBUGS-67036, https://issues.redhat.com/browse/OCPBUGS-67053, https://issues.redhat.com/browse/OCPBUGS-67070, https://issues.redhat.com/browse/OCPBUGS-67090, https://issues.redhat.com/browse/RHEL-134783, https://issues.redhat.com/browse/RHEL-134787 Signed-off-by: Tom Sweeney <tomsweney@redhat.com>

cevich · 2026-02-16T15:03:46Z

I'm assuming all the other version bumps were side-effects of the crypto & golang bump. If so, LGTM. Want me to try running this through the system tests?

TomSweeneyRedHat · 2026-02-16T16:30:33Z

@cevich if you could run it through the system tests, it would be much appreciated!

lsm5

LGTM (assuming system tests pass).

Ideally we should run integration, compose and apiv2 tests as well.

cevich · 2026-02-17T14:48:03Z

Ugg, I did a scratch build yesterday hoping that would also catch the system tests. But no, this package also requires the updated crun to function. I have a workaround for that but it takes 4-hours to run 😯 Starting it now.

cevich · 2026-02-17T17:39:51Z

The remote tests are still running, here are the local results:

0d8a107_local-rootless.txt
0d8a107_local-root.txt

(rootless) The not ok 210 image events failures is new to me, but it seems reasonable that it could be a flake caused by the event-ordering changes.
(rootless) The pasta IPv6 failures are all expected in this environment.
(rootless) The login failures are also expected (they try to use an IPv6 address)
(rootful) The not ok 305 pod resource limits timeout is new to me, may want to investigate deeper.

lsm5 · 2026-02-24T11:23:35Z

Can we defer such huge version bumps by patching the affected file during rpm build time? The actual fix for this CVE is very small.

security scanners might complain about this branch being vulnerable, in which case maybe we should move such branches to an RH-internal git host? Current CI setup on these branches isn't doing much anyway.

TomSweeneyRedHat · 2026-03-04T22:42:30Z

Putting a hold on this now as there's much discussion going on with the OCP Builder team about this patch and alternatives.

TomSweeneyRedHat · 2026-03-11T13:43:35Z

@lsm5 @cevich I've decided to take the hold off this now, and if necessary, based on continuing OCP deliberations, I may revert this later.

Given the prior comments, can we merge this and get the Jira cards moving along? @lsm5 I hear the bloat concern, but this is much smaller bloat than the Frankenstein runc one.

lsm5 · 2026-03-11T14:03:36Z

I guess we still need to run some kind of tests on this one before merging. @cevich are you / SE taking this up?

EDIT: never mind, I read the history, and Chris already ran tests. Do we want to do another run? Also, maybe e2e, apiv2 tests etc?

cevich · 2026-03-11T16:01:11Z

As a heavily biased, former QE-person, I'm always in favor of more testing and deeper 😉

TomSweeneyRedHat · 2026-03-18T22:37:31Z

@cevich have you been able to test more, and/or do we push this one along?

cevich · 2026-03-23T13:18:51Z

Happy to run our tests against this, it'll take a few hours since the manual runs can't easily operate in parallel.

cevich · 2026-03-23T13:49:30Z

 	go.opentelemetry.io/otel/metric v1.19.0 // indirect
 	go.opentelemetry.io/otel/trace v1.19.0 // indirect
-	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect


I am not a golang expert by any stretch, but I'll ask anyway: Would it make sense to have this be an explicit requirement? I'm 🤔 on the off-chance a future version breaks compatibility or introduces an unwanted bug/problem? Or would doing so risk breaking the project every time go is updated?

@cevich, maybe, but in cases like this, it's stretching my own Goland noodle, and I tend to stick with whatever the "go mod *" process cooks up.

It's probably fine, just my new paranoia working with AI where I have to question every damn thing even if it appears[1] to make sense 😞

[1]: AI's rationalize, they do not reason. Though they sure will try to convince you.

cevich · 2026-03-23T19:04:34Z

Update: The "runc" flavor of the system tests are done and all the expected ones passed. As before (and as is on #27933) the remote "default connection" test has a minor failure and all the pasta tests fail (because the test system has multiple IPv6 routes and pasta can't pick one).

I'm running the "crun" flavor now, but I am not expecting anything drastically different.

cevich · 2026-03-24T12:45:34Z

Crun testing is done, results are exactly the same by my 👁️

So from a system testing perspective on RHEL 9.2, this seems 👍

lsm5

LGTM from the system test results. If we need to run integration and others, would take a while.

lsm5 · 2026-03-28T08:39:54Z

Tested on RHEL 9.2.0-Nightly (kernel 5.14.0-284.160.1.el9_2.x86_64) via Testing Farm.

Build: podman 4.4.1 @ 0d8a107, Go 1.24.1, build tags exclude_graphdriver_btrfs seccomp systemd

System Tests

sys-local-root-crun: 498 passed, 41 failed, 127 skipped
sys-local-root-runc: 499 passed, 40 failed, 127 skipped
sys-remote-root-crun: 499 passed, 40 failed, 127 skipped
sys-remote-root-runc: 499 passed, 40 failed, 127 skipped
sys-local-rootless-crun: 527 passed, 12 failed, 162 skipped
sys-local-rootless-runc: 528 passed, 11 failed, 162 skipped
sys-remote-rootless-crun: 528 passed, 11 failed, 162 skipped
sys-remote-rootless-runc: 528 passed, 11 failed, 162 skipped

Integration Tests

int-local-root-crun: 1803 passed, 12 failed, 3 flaked, 126 skipped
int-local-root-runc: 1796 passed, 13 failed, 2 flaked, 132 skipped
int-remote-root-crun: 1564 passed, 52 failed, 1 flaked, 279 skipped
int-remote-root-runc: 1601 passed, 9 failed, 1 flaked, 285 skipped
int-local-rootless-crun: 1814 passed, 1 failed, 0 flaked, 126 skipped
int-local-rootless-runc: 1797 passed, 12 failed, 0 flaked, 132 skipped

API & Compose Tests

apiv2-bash: 1233 passed, 3 failed
apiv2-python: 44 passed, 0 failed
compose v2: 31 passed, 3 failed

Failure Analysis

All failures are environment-specific, none related to the PR changes:

Root system tests (~40 failures): systemd/quadlet/sdnotify/auto-update service startup issues + no tty in test environment
Rootless system tests (~11 failures): sigproxy, ps --external, sdnotify, tty
int-local-root-crun (12): manifest auth push, privileged device restart, ps filter, kube generate user/entrypoint
int-local-root-runc (13): same as crun + seccomp, volume copyup, idmapped volume (runc 1.2.9 compat)
int-remote-root-crun (52): remote API image operation issues (diff/save/inspect/entrypoint)
int-remote-root-runc (9): seccomp, volume, manifest push, kube generate
int-local-rootless-crun (1): manifest authenticated push (flake)
int-local-rootless-runc (12): seccomp, volume/mount driver-opts, exec, update cgroup limits (runc 1.2.9 compat)
compose (3): buildkit container name collision, MAC address mismatch, output whitespace diff

No regressions from the x/crypto bump to v0.43.0.

lsm5

LGTM

TomSweeneyRedHat · 2026-03-30T22:03:37Z

@cevich or @dashea can I get a LGTM and hopefully a merge from one or both of you please?

cevich · 2026-03-31T13:21:40Z

Ugh that's a lot of failures but as Lokesh said, many may be environmental. When I ran the system tests many more passed. So LGTM FWIW, but I don't have "merge button" authority.

dashea · 2026-04-02T17:22:40Z

LGTM. On my runs through the tests I didn't see any new failures to worry about, just the usual problems with the 1mt environment or test flakiness.

Starting with runc 1.3.0 it errors when we pass unknown mount options to the runtime, the volume-opt options are specifc to the volume we create and should not be passed to the mount in the oci spec. Fixes: podman-container-tools#26938 (originally) Follow up PR to: podman-container-tools#28092 Just before merging it was realized that the commit in this PR were also needed to completely address CVE-2025-52881 Fixes: https://issues.redhat.com/browse/OCPBUGS-67036, https://issues.redhat.com/browse/OCPBUGS-67053, https://issues.redhat.com/browse/OCPBUGS-67070, https://issues.redhat.com/browse/OCPBUGS-67090, https://issues.redhat.com/browse/RHEL-134783, https://issues.redhat.com/browse/RHEL-134787 Signed-off-by: Paul Holzinger <pholzing@redhat.com> (cherry picked from commit 4e2a04d) Signed-off-by: Tom Sweeney <tsweeney@redhat.com>

Tom Sweeney added 2 commits February 14, 2026 18:54

[v4.4.1-rhel] Bump Fedora to 42 to get Go 1.24 in .cirrus.yml

0919553

Bump Fedora to v42 to get the necessary version of Go for this change. Signed-off-by: Tom Sweeney <tomsweney@redhat.com>

TomSweeneyRedHat force-pushed the dev/tsweeney/cve-2025-47913-v4.4.1-rhel branch from 6809e0a to 0d8a107 Compare February 14, 2026 23:55

lsm5 reviewed Feb 17, 2026

View reviewed changes

TomSweeneyRedHat added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 4, 2026

TomSweeneyRedHat removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 11, 2026

cevich reviewed Mar 23, 2026

View reviewed changes

lsm5 reviewed Mar 24, 2026

View reviewed changes

lsm5 approved these changes Mar 28, 2026

View reviewed changes

lsm5 merged commit dfe1819 into podman-container-tools:v4.4.1-rhel Apr 6, 2026
6 checks passed

TomSweeneyRedHat mentioned this pull request Apr 6, 2026

[v4.4.1-rhel] do not pass volume-opt as bind mounts options to runtime #28450

Merged

6 tasks

Uh oh!

Conversation

TomSweeneyRedHat commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Does this PR introduce a user-facing change?

Uh oh!

TomSweeneyRedHat commented Feb 13, 2026

Uh oh!

cevich commented Feb 16, 2026

Uh oh!

TomSweeneyRedHat commented Feb 16, 2026

Uh oh!

lsm5 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cevich commented Feb 17, 2026

Uh oh!

cevich commented Feb 17, 2026

Uh oh!

lsm5 commented Feb 24, 2026

Uh oh!

TomSweeneyRedHat commented Mar 4, 2026

Uh oh!

TomSweeneyRedHat commented Mar 11, 2026

Uh oh!

lsm5 commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cevich commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TomSweeneyRedHat commented Mar 18, 2026

Uh oh!

cevich commented Mar 23, 2026

Uh oh!

cevich Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

cevich Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

cevich commented Mar 23, 2026

Uh oh!

cevich commented Mar 24, 2026

Uh oh!

lsm5 left a comment

Choose a reason for hiding this comment

Uh oh!

lsm5 commented Mar 28, 2026

Uh oh!

lsm5 left a comment

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat commented Mar 30, 2026

Uh oh!

cevich commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dashea commented Apr 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

TomSweeneyRedHat commented Feb 13, 2026 •

edited

Loading

lsm5 left a comment •

edited

Loading

lsm5 commented Mar 11, 2026 •

edited

Loading

cevich commented Mar 11, 2026 •

edited

Loading

cevich commented Mar 31, 2026 •

edited

Loading