Skip to content

[release-4.19] OCPBUGS-80420: Bump google.golang.org/grpc to v1.79.3 #199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ocp-sustaining-admins wants to merge 2 commits into
base: release-4.19
Choose a base branch
from
Open

[release-4.19] OCPBUGS-80420: Bump google.golang.org/grpc to v1.79.3 #199

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bf64af4
OCPBUGS-80420: Bump google.golang.org/grpc to v1.79.3
rh-arc[bot] May 1, 2026
1f32218
fix lint issue and timeout
MrSanketkumar May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
4 changes: 3 additions & 1 deletion .golangci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
run:
# Default timeout is 1m, up to give more room
timeout: 4m
timeout: 10m
# Limit concurrency to reduce memory usage in CI
concurrency: 2

linters:
enable:
Expand Down
41 changes: 22 additions & 19 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ toolchain go1.23.4

require (
github.com/blang/semver/v4 v4.0.0
github.com/go-logr/logr v1.4.2
github.com/go-logr/logr v1.4.3
github.com/openshift/api v0.0.0-20250426060331-e577b4d83475
github.com/openshift/build-machinery-go v0.0.0-20250102153059-e85a1a7ecb5c
github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7
Expand All @@ -17,9 +17,8 @@ require (
github.com/operator-framework/operator-registry v1.48.0
github.com/spf13/cobra v1.8.1
github.com/spf13/pflag v1.0.5
github.com/stretchr/testify v1.9.0
golang.org/x/net v0.30.0
golang.org/x/text v0.19.0
github.com/stretchr/testify v1.10.0
golang.org/x/text v0.26.0
helm.sh/helm/v3 v3.16.2
k8s.io/api v0.32.2
k8s.io/apiextensions-apiserver v0.32.2
Expand All @@ -32,7 +31,7 @@ require (
)

require (
cel.dev/expr v0.18.0 // indirect
cel.dev/expr v0.24.0 // indirect
github.com/Masterminds/semver/v3 v3.3.0 // indirect
github.com/Masterminds/squirrel v1.5.4 // indirect
github.com/NYTimes/gziphandler v1.1.1 // indirect
Expand Down Expand Up @@ -60,7 +59,7 @@ require (
github.com/google/btree v1.1.2 // indirect
github.com/google/cel-go v0.22.0 // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
github.com/google/uuid v1.6.0 // indirect
Expand Down Expand Up @@ -101,28 +100,30 @@ require (
go.etcd.io/etcd/api/v3 v3.5.16 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.16 // indirect
go.etcd.io/etcd/client/v3 v3.5.16 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
go.opentelemetry.io/otel v1.29.0 // indirect
go.opentelemetry.io/otel v1.37.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
go.opentelemetry.io/otel/metric v1.29.0 // indirect
go.opentelemetry.io/otel/sdk v1.29.0 // indirect
go.opentelemetry.io/otel/trace v1.29.0 // indirect
go.opentelemetry.io/otel/metric v1.37.0 // indirect
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
go.opentelemetry.io/otel/trace v1.37.0 // indirect
Comment on lines +106 to +111
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

`What are the first patched versions for:

  1. GHSA-mh2q-q3fh-2475 (go.opentelemetry.io/otel),
  2. GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx (go.opentelemetry.io/otel/sdk)?
    Please include official advisories/release notes.`

💡 Result:

First patched versions (per official GitHub security advisories for open-telemetry/opentelemetry-go): 1) GHSA-mh2q-q3fh-2475 (go.opentelemetry.io/otel) - First patched version: go.opentelemetry.io/otel v1.41.0 [1] 2) GHSA-9h8m-3fm2-qjrq (go.opentelemetry.io/otel/sdk) - First patched version: go.opentelemetry.io/otel/sdk v1.40.0 [2] 3) GHSA-hfvc-g4fc-pqhx (go.opentelemetry.io/otel/sdk) - First patched version: Not found in the accessible official advisory/release note sources returned in this research run. - (The OpenTelemetry Go security advisories index shows GHSA-hfvc-g4fc-pqhx exists and is published on Apr 8, 2026, but the returned snippets did not include the “Patched versions” field needed to determine the first patched version.) [3][4] Notes / official advisories referenced: - GHSA-mh2q-q3fh-2475 lists patched version v1.41.0 for go.opentelemetry.io/otel. [1] - GHSA-9h8m-3fm2-qjrq lists patched version 1.40.0 for go.opentelemetry.io/otel/sdk (macOS/Darwin ioreg PATH hijacking; patched in d45961b released with v1.40.0). [2] - The official OpenTelemetry Go security advisory index confirms GHSA-hfvc-g4fc-pqhx is an OpenTelemetry Go advisory published Apr 8, 2026, but the returned excerpt did not expose patched version details. [3][4]

Citations:

🌐 Web query:

GHSA-mh2q-q3fh-2475 go.opentelemetry.io/otel vulnerability details and severity

💡 Result:

GHSA-mh2q-q3fh-2475 is a high-severity vulnerability in the OpenTelemetry Go SDK (go.opentelemetry.io/otel), specifically in the baggage propagation module. It involves multi-value baggage header extraction causing excessive allocations, enabling remote DoS amplification via specially crafted HTTP requests with many multi-value baggage headers[1][2][3][4]. Severity is HIGH with CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impacting availability[1][3]. Published on April 7, 2026[1][3]. The vulnerable code is in propagation/baggage.go:58 extractMultiBaggage[3]. Applications using the vulnerable opentelemetry-go library that process inbound HTTP requests are affected[2]. Fix is available; upgrade to patched versions (specific versions not detailed in snippets, check official advisory)[1].

Citations:

🌐 Web query:

GHSA-hfvc-g4fc-pqhx go.opentelemetry.io/otel/sdk patched version and details

💡 Result:

GHSA-hfvc-g4fc-pqhx is a security advisory for an incomplete fix in go.opentelemetry.io/otel/sdk. It affects versions >= v1.15.0 and <= v1.42.0. The vulnerability allows PATH hijacking on BSD and Solaris platforms because the BSD kenv command in sdk/resource/host_id.go does not use an absolute path (e.g., /bin/kenv), unlike the fixed Darwin ioreg command from prior advisory GHSA-9h8m-3fm2-qjrq (CVE-2026-24051).[1][2][3] The issue was fixed by changing execCommand("kenv",...) to execCommand("/bin/kenv",...) in commit #8113, included in the v1.43.0 release on 2026-04-03.[1][2][4][3] Patched version: v1.43.0 and later.[1][5][2][6]

Citations:

OpenTelemetry v1.37.0 is vulnerable to three confirmed HIGH-severity security advisories.

The versions pinned here (go.opentelemetry.io/otel, go.opentelemetry.io/otel/sdk, etc. at v1.37.0) are below patched versions for:

  • GHSA-mh2q-q3fh-2475 (otel v1.37.0 < v1.41.0): Remote DoS via excessive allocations in baggage propagation (CVSS 7.5)
  • GHSA-9h8m-3fm2-qjrq (otel/sdk v1.37.0 < v1.40.0): PATH hijacking on macOS/Darwin via ioreg command
  • GHSA-hfvc-g4fc-pqhx (otel/sdk v1.37.0 < v1.43.0): PATH hijacking on BSD/Solaris via kenv command (incomplete prior fix)

Upgrade to v1.43.0 or later to address all three.

🧰 Tools
🪛 OSV Scanner (2.3.6)

[HIGH] 106-106: go.opentelemetry.io/otel 1.37.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)

(GHSA-mh2q-q3fh-2475)

[HIGH] 110-110: go.opentelemetry.io/otel/sdk 1.37.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk

(GO-2026-4394)

[HIGH] 110-110: go.opentelemetry.io/otel/sdk 1.37.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

(GHSA-9h8m-3fm2-qjrq)

[HIGH] 110-110: go.opentelemetry.io/otel/sdk 1.37.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

(GHSA-hfvc-g4fc-pqhx)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 106 - 111, The listed OpenTelemetry dependencies
(go.opentelemetry.io/otel, go.opentelemetry.io/otel/exporters/otlp/otlptrace,
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk,
go.opentelemetry.io/otel/trace) are pinned to v1.37.0 which is vulnerable;
update these module versions to v1.43.0 (or later) to include the security
fixes, then run module resolution (e.g., go get <module>@v1.43.0 and go mod
tidy) to ensure the go.mod and go.sum are consistent and build passes.

go.opentelemetry.io/proto/otlp v1.3.1 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/crypto v0.28.0 // indirect
golang.org/x/crypto v0.39.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/oauth2 v0.23.0 // indirect
golang.org/x/sync v0.8.0 // indirect
golang.org/x/sys v0.26.0 // indirect
golang.org/x/term v0.25.0 // indirect
golang.org/x/net v0.41.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.15.0 // indirect
golang.org/x/sys v0.33.0 // indirect
golang.org/x/term v0.32.0 // indirect
golang.org/x/time v0.7.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 // indirect
google.golang.org/grpc v1.67.1 // indirect
google.golang.org/protobuf v1.35.1 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/grpc v1.71.0 // indirect
google.golang.org/protobuf v1.36.6 // indirect
Comment on lines +125 to +126
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod grpc lines =="
rg -n 'google\.golang\.org/grpc|openshift-sustaining/grpc-go|replace ' go.mod

echo
echo "== vendor/modules.txt grpc resolution (if vendored) =="
if [ -f vendor/modules.txt ]; then
  rg -n 'google\.golang\.org/grpc|openshift-sustaining/grpc-go' vendor/modules.txt
else
  echo "vendor/modules.txt not present in this checkout."
fi

Repository: openshift/cluster-olm-operator

Length of output: 3598

🏁 Script executed:

# Check for PR or commit metadata that shows the target version
git log --oneline -20 | head -20

Repository: openshift/cluster-olm-operator

Length of output: 110

🏁 Script executed:

# Search for any comments or documentation about the grpc fork choice
rg -i 'v1\.79|v1\.75|grpc-go|openshift-sustaining' --max-count=20 -B2 -A2 go.mod go.sum 2>/dev/null || true

Repository: openshift/cluster-olm-operator

Length of output: 830

🌐 Web query:

github.com/openshift-sustaining/grpc-go v1.75.1-sec.1 CVE security fix

💡 Result:

The OpenShift Sustaining gRPC-Go security fix for v1.75.1-sec.1 is tied to the gRPC authorization-bypass vulnerability published as CVE-2026-33186 (GHSA-p77j-4mvh-x3m3). The upstream fix is included in google.golang.org/grpc v1.79.3, where malformed HTTP/2:path values missing the leading slash are rejected immediately (Unimplemented), preventing authorization interceptors from evaluating a non-canonical path and bypassing deny rules. [1][2][3] Evidence and what to do: 1) Vulnerability description and affected versions: CVE-2026-33186 is an authorization bypass in google.golang.org/grpc resulting from improper input validation of the HTTP/2:path pseudo-header; affected versions are google.golang.org/grpc < v1.79.3. [1][2] 2) Upstream/scan-driven fix version: Fix available in grpc v1.79.3 (Kubernetes autoscaler issue referencing the fix). [4] 3) How OpenShift Sustaining consumes this fix: OpenShift Sustaining PRs explicitly bump google.golang.org/grpc from v1.75.1 to v1.79.3 “to address CVE-2026-33186” (e.g., cluster-monitoring-operator). [5] 4) Release engineering workflow evidence: The Sustaining bump PRs are generated by running “go get google.golang.org/grpc@v1.79.3” followed by go mod tidy and vendor updates. [6][7] Practical takeaway (for any component still on v1.75.1-sec.1 / <1.79.3): upgrade google.golang.org/grpc to v1.79.3 (or later) to receive the fix for CVE-2026-33186. [5][4][2]

Citations:

🌐 Web query:

grpc-go v1.79.3 release security fixes CVE

💡 Result:

grpc-go v1.79.3 was released on 2026-03-17 to fix CVE-2026-33186, a critical authorization bypass vulnerability (CVSS 9.1) in versions prior to 1.79.3 [1][2][3]. The issue allows attackers to bypass path-based authorization rules in interceptors like grpc/authz by sending HTTP/2 requests with malformed:path headers missing the leading slash (e.g., Service/Method instead of /Service/Method). The server routes these requests correctly, but interceptors fail to match "deny" rules on canonical paths, falling back to "allow" if present [2][4][3]. The fix rejects any request without a leading slash in:path with an Unimplemented error before reaching interceptors [1][3]. Affected servers use path-based auth with default-allow policies. Upgrade to v1.79.3 or later [5][6][7].

Citations:

Verify grpc fork contains all intended CVE fixes or clarify version targeting strategy.

go.mod resolves grpc to github.com/openshift-sustaining/grpc-go v1.75.1-sec.1 (Line 142), a backport of CVE-2026-33186 fixes to grpc v1.75.1. However, the full upstream fix is available in grpc v1.79.3. This gap between the fork (v1.75.1) and upstream (v1.79.3) means post-1.75 security patches are not included. Other OpenShift projects (e.g., cluster-monitoring-operator) directly upgrade to v1.79.3 rather than using the fork. Confirm whether the fork includes all necessary fixes beyond CVE-2026-33186, or whether upgrading to v1.79.3 directly is the intended approach.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 125 - 126, The go.mod currently pins grpc to the
OpenShift fork github.com/openshift-sustaining/grpc-go v1.75.1-sec.1; confirm
whether that fork contains all post-1.75 security/backport fixes (not just
CVE-2026-33186) or whether the project should instead upgrade to the upstream
google.golang.org/grpc v1.79.3; to fix, audit the fork's changelog/commit
differences against upstream v1.79.3 for any missing CVE fixes and either (a)
document/confirm in the PR that the fork includes all required fixes (reference
github.com/openshift-sustaining/grpc-go v1.75.1-sec.1 and CVE-2026-33186) or (b)
update go.mod to target google.golang.org/grpc v1.79.3 and run go mod tidy and
tests to ensure compatibility.

gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
Expand All @@ -137,3 +138,5 @@ require (
sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
)

replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.75.1-sec.1
90 changes: 48 additions & 42 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion pkg/controller/dynamicrequiredmanifest_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package controller

import (
"context"
"fmt"

operatorv1 "github.com/openshift/api/operator/v1"
Expand All @@ -9,7 +10,6 @@ import (
"github.com/openshift/library-go/pkg/controller/factory"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/management"
"golang.org/x/net/context"
"k8s.io/apimachinery/pkg/api/equality"
"k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
Expand Down
2 changes: 1 addition & 1 deletion vendor/cel.dev/expr/.bazelversion
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
7.0.1
7.3.2
# Keep this pinned version in parity with cel-go
34 changes: 19 additions & 15 deletions vendor/cel.dev/expr/MODULE.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,26 +8,38 @@ bazel_dep(
)
bazel_dep(
name = "gazelle",
version = "0.36.0",
version = "0.39.1",
repo_name = "bazel_gazelle",
)
bazel_dep(
name = "googleapis",
version = "0.0.0-20240819-fe8ba054a",
version = "0.0.0-20241220-5e258e33.bcr.1",
repo_name = "com_google_googleapis",
)
bazel_dep(
name = "googleapis-cc",
version = "1.0.0",
)
bazel_dep(
name = "googleapis-java",
version = "1.0.0",
)
bazel_dep(
name = "googleapis-go",
version = "1.0.0",
)
bazel_dep(
name = "protobuf",
version = "26.0",
version = "27.0",
repo_name = "com_google_protobuf",
)
bazel_dep(
name = "rules_cc",
version = "0.0.9",
version = "0.0.17",
)
bazel_dep(
name = "rules_go",
version = "0.49.0",
version = "0.53.0",
repo_name = "io_bazel_rules_go",
)
bazel_dep(
Expand All @@ -36,7 +48,7 @@ bazel_dep(
)
bazel_dep(
name = "rules_proto",
version = "6.0.0",
version = "7.0.2",
)
bazel_dep(
name = "rules_python",
Expand All @@ -50,16 +62,8 @@ python.toolchain(
python_version = "3.11",
)

switched_rules = use_extension("@com_google_googleapis//:extensions.bzl", "switched_rules")
switched_rules.use_languages(
cc = True,
go = True,
java = True,
)
use_repo(switched_rules, "com_google_googleapis_imports")

go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
go_sdk.download(version = "1.21.1")
go_sdk.download(version = "1.22.0")

go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
go_deps.from_file(go_mod = "//:go.mod")
Expand Down
2 changes: 0 additions & 2 deletions vendor/cel.dev/expr/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,5 +69,3 @@ For more detail, see:
* [Language Definition](doc/langdef.md)
Released under the [Apache License](LICENSE).
Disclaimer: This is not an official Google product.
2 changes: 1 addition & 1 deletion vendor/cel.dev/expr/cloudbuild.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
steps:
- name: 'gcr.io/cloud-builders/bazel:7.0.1'
- name: 'gcr.io/cloud-builders/bazel:7.3.2'
entrypoint: bazel
args: ['build', '...']
id: bazel-build
Expand Down
Loading