forked from kubernetes-sigs/aws-ebs-csi-driver
-
Notifications
You must be signed in to change notification settings - Fork 27
OCPBUGS-83900: UPSTREAM: 2911: bump google.golang.org/grpc v1.80.0 to fix CVE-2026-33186 #316
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
kunalmemane
wants to merge
1
commit into
openshift:release-4.22
Choose a base branch
from
kunalmemane:CVE-2026-33186-4.22
base: release-4.22
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
Are there security vulnerabilities GHSA-mh2q-q3fh-2475, GO-2026-4394, GHSA-9h8m-3fm2-qjrq, and GHSA-hfvc-g4fc-pqhx affecting go.opentelemetry.io/otel v1.39.0 and is there a patched version available?💡 Result:
Yes, for go.opentelemetry.io/otel v1.39.0: 1) GHSA-mh2q-q3fh-2475 - Affects: go.opentelemetry.io/otel/baggage in versions >= v1.36.0 and <= v1.40.0, so v1.39.0 is affected [1][2]. - Issue: multi-value “baggage” header extraction can cause excessive allocations (remote DoS amplification) [1]. - Patched version: the advisory indicates a fix is available, but it does not explicitly name the exact fixed version in the snippet we captured [1][2]. 2) GO-2026-4394 (CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq) - Affects: go.opentelemetry.io/otel/sdk for versions from v1.21.0 up to (before) v1.40.0, so v1.39.0 is affected [3]. - Issue: arbitrary code execution via PATH hijacking on macOS/Darwin [4][3]. - Patched version: patched in v1.40.0 [4][3]. 3) GHSA-9h8m-3fm2-qjrq - Same as
#2above; v1.39.0 is affected and v1.40.0 is the patched release [4][3]. 4) GHSA-hfvc-g4fc-pqhx - In the sources retrieved so far, I did not find an authoritative advisory page or a Go vulnerability entry for GHSA-hfvc-g4fc-pqhx specifically tied to go.opentelemetry.io/otel (so I can’t confirm whether it affects v1.39.0 or provide a patched version based on evidence gathered) [not found in retrieved results]. What to do - If you need a single remediation baseline for the confirmed PATH-hijacking issue: upgrade go.opentelemetry.io/otel to v1.40.0 or later [4][3]. - Also address GHSA-mh2q-q3fh-2475 by applying the GHSA-provided fix for the baggage multi-value parsing issue (confirm the exact fixed version from the advisory page) [1][2].Citations:
🌐 Web query:
GHSA-mh2q-q3fh-2475 go.opentelemetry.io/otel patched version exact release💡 Result:
Patched (exact) version for GHSA-mh2q-q3fh-2475 in go.opentelemetry.io/otel: v1.41.0 (released 2026-03-02) [1]. Evidence: the GitHub advisory for GHSA-mh2q-q3fh-2475 states the vulnerability is fixed in 1.41.0 (and only affects versions from 1.36.0 up to excluding 1.41.0) [2]. The v1.41.0 release tag exists at https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0 and corresponds to go.opentelemetry.io/otel v1.41.0 [1].
Citations:
🌐 Web query:
GHSA-hfvc-g4fc-pqhx vulnerability details affected package💡 Result:
The GHSA-hfvc-g4fc-pqhx vulnerability affects the go.opentelemetry.io/otel/sdk package, specifically in the resource detection module on BSD and Solaris platforms [1][2][3]. It is an incomplete fix for the prior GHSA-9h8m-3fm2-qjrq (CVE-2026-24051), where the BSD kenv command in sdk/resource/host_id.go was not updated to use an absolute path (/bin/kenv), allowing PATH hijacking if a malicious kenv binary is placed earlier in $PATH [1][2][4]. This occurs during OpenTelemetry resource detection at startup when /etc/hostid does not exist, which is common on FreeBSD [1]. Affected platforms include DragonFly BSD, FreeBSD, NetBSD, OpenBSD, and Solaris [1][2]. Vulnerable versions are >=1.15.0-rc.2 and <1.43.0 for github.com/open-telemetry/opentelemetry-go/sdk/resource [3]. The fix uses the absolute path "/bin/kenv" [1][4]. Any Go application importing go.opentelemetry.io/otel/sdk and running on affected platforms with local attacker access is vulnerable [1]. This vulnerability also impacts downstream packages like opentelemetry-collector-contrib-fips <0.149.0-r2 and etcd-3.5 <3.5.29-r2 in certain distros [5][6]. Severity is rated HIGH (7.3) by some sources [7]. Upgrade to go.opentelemetry.io/otel/sdk v1.43.0 or later [3][4].
Citations:
🌐 Web query:
go.opentelemetry.io/otel v1.40.0 release notes security💡 Result:
Security-related items in go.opentelemetry.io/otel v1.40.0 (OpenTelemetry Go) include fixing a Path Hijacking/arbitrary code execution issue in the SDK’s resource detection. 1) GO-2026-4394 / GHSA-9h8m-3fm2-qjrq (CVE-2026-24051): PATH hijacking leading to arbitrary code execution - Affected component: go.opentelemetry.io/otel/sdk (resource detection), specifically the host ID reader that executes the macOS command ioreg from sdk/resource/host_id.go. [1][2] - Vulnerable versions: v1.21.0 through before v1.40.0 (per the Go vulnerability entry). [1] - Impact: attacker with ability to modify PATH locally could get the application to execute a malicious ioreg binary, resulting in arbitrary code execution in the application context. [1][2] - Fix: patched in d45961b and released with v1.40.0. [1][2] 2) What to do - If you run macOS/Darwin and use the Go SDK (go.opentelemetry.io/otel/sdk), upgrade to go.opentelemetry.io/otel v1.40.0 or later to include the fix. [1][2] Additional security-relevant context from the ecosystem - The same line of fixes was described in a later Docker Scout report noting that the fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed ioreg to an absolute path, and highlighted that other OS commands needed analogous hardening; that issue is tracked separately and not limited to v1.40.0 itself. [3]
Citations:
Upgrade to v1.43.0 or later to resolve multiple HIGH severity security vulnerabilities in go.opentelemetry.io/otel.
v1.39.0 is affected by three HIGH severity security vulnerabilities:
Upgrade to v1.43.0 or later to address all three vulnerabilities.
Also applies to: lines 26, 85-87
🧰 Tools
🪛 OSV Scanner (2.3.6)
[HIGH] 23-23: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value
baggageheader extraction causes excessive allocations (remote dos amplification)(GHSA-mh2q-q3fh-2475)
🤖 Prompt for AI Agents