[release/1.7] silence govulncheck false positives#11679
Merged
AkihiroSuda merged 1 commit intocontainerd:release/1.7from Apr 11, 2025
Merged
[release/1.7] silence govulncheck false positives#11679AkihiroSuda merged 1 commit intocontainerd:release/1.7from
AkihiroSuda merged 1 commit intocontainerd:release/1.7from
Conversation
0492741 to
bd41d73
Compare
AkihiroSuda
commented
Apr 10, 2025
| module github.com/containerd/containerd | ||
|
|
||
| go 1.21 | ||
| go 1.23.0 |
`govulncheck -mode=binary` detected the following vulns, but `-mode=source` says "your code doesn't appear to call these vulnerabilities." ``` === Symbol Results === Vulnerability #1: GO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net More info: https://pkg.go.dev/vuln/GO-2025-3503 Module: golang.org/x/net Found in: golang.org/x/net@v0.33.0 Fixed in: golang.org/x/net@v0.36.0 Vulnerable symbols found: #1: httpproxy.config.useProxy containerd#2: httpproxy.domainMatch.match containerd#3: proxy.Dial containerd#4: proxy.FromEnvironment containerd#5: proxy.FromEnvironmentUsing Use '-show traces' to see the other 3 found symbols Vulnerability containerd#2: GO-2025-3488 Unexpected memory consumption during token parsing in golang.org/x/oauth2 More info: https://pkg.go.dev/vuln/GO-2025-3488 Module: golang.org/x/oauth2 Found in: golang.org/x/oauth2@v0.11.0 Fixed in: golang.org/x/oauth2@v0.27.0 Vulnerable symbols found: #1: jws.Verify Vulnerability containerd#3: GO-2025-3487 Potential denial of service in golang.org/x/crypto More info: https://pkg.go.dev/vuln/GO-2025-3487 Module: golang.org/x/crypto Found in: golang.org/x/crypto@v0.31.0 Fixed in: golang.org/x/crypto@v0.35.0 Vulnerable symbols found: #1: ssh.Client.Dial containerd#2: ssh.Client.DialContext containerd#3: ssh.Client.DialTCP containerd#4: ssh.Client.Listen containerd#5: ssh.Client.ListenTCP Use '-show traces' to see the other 48 found symbols Your code is affected by 3 vulnerabilities from 3 modules. This scan found no other vulnerabilities in packages you import or modules you require. Use '-show verbose' for more details. ``` NOTE: Go version requirement is now bumped up from 1.21 to 1.23 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
estesp
approved these changes
Apr 10, 2025
Member
Author
|
CI failure seems irrelevant https://github.com/containerd/containerd/actions/runs/14385903219/job/40363087812?pr=11679 Likely to be an issue of the kernel: |
austinvazquez
approved these changes
Apr 11, 2025
Member
|
@akhilerm reported the issue actions/runner-images#11985 for the CI failure. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
govulncheck -mode=binarydetected the following vulns, but-mode=sourcesays "your code doesn't appear to call these vulnerabilities."NOTE: Go version requirement is now bumped up from 1.21 to 1.23
Fix #11668