fix(deps): replace golang.org/x/crypto to fix CVE-2026-39830#8859
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
60bb477 to
cfe094f
Compare
cfe094f to
9c38afa
Compare
csrwng
added
approved
|
Scheduling required tests: |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: yiraeChristineKim The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
9c38afa to
fbf9bd1
Compare
fbf9bd1 to
b7c63a7
Compare
Replace golang.org/x/crypto with the patched fork github.com/yiraeChristineKim/crypto v0.39.1-sec.2 to fix CVE-2026-39830 (GO-2026-5017). CVE-2026-39830: a malicious SSH peer could send unsolicited global request responses to fill the internal globalResponses channel buffer (size 1), causing handleGlobalPacket to block indefinitely and stall the connection's read loop. Calling Close() could not release the blocked goroutine, resulting in a resource leak per connection. Fix: replace the blocking send in handleGlobalPacket with a conditional non-blocking send gated on globalSentPending. A drain loop in SendRequest discards any stale buffered responses before sending a new request. The upstream fix shipped in v0.52.0 which requires go 1.25.0, incompatible with the release-4.19 builders (go 1.23). The fork backports the fix onto v0.39.0 keeping go 1.23.0 in go.mod. Fork: https://github.com/yiraeChristineKim/crypto/tree/sec-patch-v0.39.1 Upstream fix: golang/crypto@4e7a7384ecbc Fixes: https://redhat.atlassian.net/browse/ACM-35720 CVE: CVE-2026-39830 Co-authored-by: Cursor <cursoragent@cursor.com>
b7c63a7 to
9ecb27f
Compare
yiraeChristineKim
changed the title
|
/retest |
1 similar comment
|
/retest |
|
/lgtm |
|
Scheduling required tests: |
|
/retest |
|
/retest |
|
/test e2e-aws |
|
@yiraeChristineKim: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Summary
Fixes CVE-2026-39830 (GO-2026-5017) in
golang.org/x/crypto/sshby replacing the module with a patched fork via ago.modreplacedirective, following the same pattern as the grpc CVE fix (see commit3684079).Vulnerability Details
CVE-2026-39830 —
golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses.golang.org/x/crypto v0.52.0Why a fork instead of bumping to v0.52.0?
golang.org/x/crypto v0.52.0requiresgo 1.25.0. The release-4.19 builders use Go 1.23 (go-toolset:1.23.6), making a direct bump incompatible.The fix backports upstream commit golang/crypto@4e7a7384ecbc onto
v0.39.0, keepinggo 1.23.0in the fork'sgo.mod. No Go 1.25 language features are used.Changes
go.modreplace golang.org/x/crypto => github.com/yiraeChristineKim/crypto v0.39.1-sec.2go.sumgo mod tidy)vendor/golang.org/x/crypto/ssh/mux.gogo mod vendorfrom the forkvendor/modules.txtFork: https://github.com/yiraeChristineKim/crypto/tree/sec-patch-v0.39.1
Upstream fix: golang/crypto@4e7a7384ecbc
CVE: CVE-2026-39830
Test plan
ci/prow/verifypassesci/prow/verify-depspasses