[Project Darkstar] ROSAENG-60658: Remediate CVE-2026-27145, CVE-2026-42504 in rosa#3382
[Project Darkstar] ROSAENG-60658: Remediate CVE-2026-27145, CVE-2026-42504 in rosa#3382kseiter-rh wants to merge 1 commit into
Conversation
…42504 — update Go toolchain directive to 1.26.4 Addresses CVE-2026-27145 (Important, CVSS 7.5) and CVE-2026-42504 (Important, CVSS 7.5), both fixed in Go 1.26.4. Bumps the go directive in go.mod from 1.26.3 to 1.26.4 to formally enforce the minimum Go toolchain version; builder Dockerfiles already use go-toolset:1.26.4. Ref: ROSAENG-60658, ROSAENG-60661 Project Darkstar — automated CVE remediation (contact: Kevin Seiter) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@kseiter-rh: This pull request references ROSAENG-60658 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
📝 WalkthroughWalkthroughThe Go toolchain directive in Possibly related issues
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: kseiter-rh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: Update the Go version pin in renovate.json to match the approved
version declared in go.mod, changing it from 1.26.3 to 1.26.4 so Renovate
targets the current version.
- Line 3: Update the Go version from 1.26.4 to at least 1.26.5 consistently in
the go.mod toolchain declaration, the Go builder image pins in Dockerfile,
images/Dockerfile.e2e, and images/Dockerfile.konflux, and the corresponding
version configuration in renovate.json.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: bfcf9269-515a-454f-bf3e-e4ec013e5d1f
📒 Files selected for processing (1)
go.mod
| module github.com/openshift/rosa | ||
|
|
||
| go 1.26.3 | ||
| go 1.26.4 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Synchronize the Renovate Go pin.
renovate.json still specifies Go 1.26.3, so automation can continue targeting a stale version after this change. Update that pin to the same approved Go version as go.mod.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, Update the Go version pin in renovate.json to match the
approved version declared in go.mod, changing it from 1.26.3 to 1.26.4 so
Renovate targets the current version.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- go.mod ---\n'
cat -n go.mod | sed -n '1,20p'
printf '\n--- Dockerfile matches ---\n'
rg -n 'go\s+1\.26|1\.26\.' Dockerfile* . || true
printf '\n--- renovate.json ---\n'
cat -n renovate.json | sed -n '1,220p' || trueRepository: openshift/rosa
Length of output: 243
🌐 Web query:
Go 1.26.5 release July 7 2026 CVE-2026-42505 OSV Go 1.26.4 1.26.5
💡 Result:
Go 1.26.5 was released on July 7, 2026, to address security vulnerabilities and include various bug fixes [1][2]. CVE-2026-42505 refers to a privacy vulnerability in the crypto/tls package where the Encrypted Client Hello (ECH) implementation would leak pre-shared key (PSK) identities during the handshake [3][4]. This leak allowed a passive network observer to de-anonymize the server's hostname even when ECH was in use [5][3]. The fix, addressed in Go 1.26.5 and Go 1.25.12, involves omitting the PSK extension in the outer client hello when using ECH [6]. Additionally, Go 1.26.5 addresses CVE-2026-39822, a root escape vulnerability in the os package on Unix systems where paths with trailing slashes could improperly follow symlinks outside of a specified os.Root [3][4]. Go 1.26.5 includes the following changes from Go 1.26.4: - Security fixes for CVE-2026-42505 and CVE-2026-39822 [1][3]. - Bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages [1][7]. For users compiling from source, the release can be accessed by checking out the tag go1.26.5 [2].
Citations:
- 1: https://go.dev/doc/devel/release
- 2: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
- 3: https://seclists.org/oss-sec/2026/q3/102
- 4: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc/m/G9tnwhteAAAJ
- 5: https://pkg.go.dev/vuln/GO-2026-5856
- 6: golang/go@137b806
- 7: https://tip.golang.org/doc/devel/release
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- go.mod ---'
cat -n go.mod | sed -n '1,20p'
echo
echo '--- Dockerfile* Go version matches ---'
rg -n '1\.26\.[0-9]+' Dockerfile* . || true
echo
echo '--- renovate.json ---'
if [ -f renovate.json ]; then
cat -n renovate.json | sed -n '1,240p'
fiRepository: openshift/rosa
Length of output: 18204
Bump the Go toolchain to 1.26.5+
go.mod is still on 1.26.4, and the Go builder images are pinned there too (Dockerfile, images/Dockerfile.e2e, images/Dockerfile.konflux). Update these pins together and align renovate.json, since 1.26.5 carries the current Go 1.26 security fixes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, Update the Go version from 1.26.4 to at least 1.26.5
consistently in the go.mod toolchain declaration, the Go builder image pins in
Dockerfile, images/Dockerfile.e2e, and images/Dockerfile.konflux, and the
corresponding version configuration in renovate.json.
Source: Path instructions
|
Hi @kseiter-rh , thanks for submitting the PR Bumping Go is planned after this PR is merged: Would be OK to wait and follow this plan instead of bumping immediately? Our CI is not prepared for that. |
3 participants
Project Darkstar — Automated CVE Remediation
Summary
godirective ingo.modfrom 1.26.3 to 1.26.4go-toolset:1.26.4; this update formally enforces the minimum Go toolchain requirementCVE Details
CVE-2026-27145 (Important, CVSS 7.5)
crypto/x509(Go stdlib)(*x509.Certificate).VerifyHostnamecalledstrings.Split(host, ".")repeatedly in a loop over all DNS SAN entries, causing quadratic verification cost with large SAN lists. Exploitable by unauthenticated clients presenting a crafted certificate.CVE-2026-42504 (Important, CVSS 7.5)
mime(Go stdlib)WordDecoder.DecodeHeaderexhibited quadratic complexity when processing maliciously crafted MIME headers, enabling denial-of-service attacks.Changes
go.mod:go 1.26.3→go 1.26.4Already Fixed (11 CVEs — no action needed)
The following CVEs discovered in Jira were already resolved by previous automated dependency updates:
Verification
go build ./...passesgo-toolset:1.26.4)References
Project Darkstar — Automated CVE Remediation | Contact: Kevin Seiter (ROSA Trust Engineering)
Summary by CodeRabbit