From 14039c9089a815c3c1fe6891e59cc0945ac44c34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Mon, 3 Nov 2025 15:16:36 +0100 Subject: [PATCH] golang: Update to 1.24.9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In order to fix: ``` === Running govulncheck on containerd-shim-kata-v2 === Vulnerabilities found in containerd-shim-kata-v2: === Symbol Results === Vulnerability #1: GO-2025-4015 Excessive CPU consumption in Reader.ReadResponse in net/textproto More info: https://pkg.go.dev/vuln/GO-2025-4015 Standard library Found in: net/textproto@go1.24.6 Fixed in: net/textproto@go1.24.8 Vulnerable symbols found: #1: textproto.Reader.ReadResponse Vulnerability #2: GO-2025-4014 Unbounded allocation when parsing GNU sparse map in archive/tar More info: https://pkg.go.dev/vuln/GO-2025-4014 Standard library Found in: archive/tar@go1.24.6 Fixed in: archive/tar@go1.24.8 Vulnerable symbols found: #1: tar.Reader.Next Vulnerability #3: GO-2025-4013 Panic when validating certificates with DSA public keys in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2025-4013 Standard library Found in: crypto/x509@go1.24.6 Fixed in: crypto/x509@go1.24.8 Vulnerable symbols found: #1: x509.Certificate.Verify #2: x509.Certificate.Verify Vulnerability #4: GO-2025-4012 Lack of limit when parsing cookies can cause memory exhaustion in net/http More info: https://pkg.go.dev/vuln/GO-2025-4012 Standard library Found in: net/http@go1.24.6 Fixed in: net/http@go1.24.8 Vulnerable symbols found: #1: http.Client.Do #2: http.Client.Get #3: http.Client.Head #4: http.Client.Post #5: http.Client.PostForm Use '-show traces' to see the other 9 found symbols Vulnerability #5: GO-2025-4011 Parsing DER payload can cause memory exhaustion in encoding/asn1 More info: https://pkg.go.dev/vuln/GO-2025-4011 Standard library Found in: encoding/asn1@go1.24.6 Fixed in: encoding/asn1@go1.24.8 Vulnerable symbols found: #1: asn1.Unmarshal #2: asn1.UnmarshalWithParams Vulnerability #6: GO-2025-4010 Insufficient validation of bracketed IPv6 hostnames in net/url More info: https://pkg.go.dev/vuln/GO-2025-4010 Standard library Found in: net/url@go1.24.6 Fixed in: net/url@go1.24.8 Vulnerable symbols found: #1: url.JoinPath #2: url.Parse #3: url.ParseRequestURI #4: url.URL.Parse #5: url.URL.UnmarshalBinary Vulnerability #7: GO-2025-4009 Quadratic complexity when parsing some invalid inputs in encoding/pem More info: https://pkg.go.dev/vuln/GO-2025-4009 Standard library Found in: encoding/pem@go1.24.6 Fixed in: encoding/pem@go1.24.8 Vulnerable symbols found: #1: pem.Decode Vulnerability #8: GO-2025-4008 ALPN negotiation error contains attacker controlled information in crypto/tls More info: https://pkg.go.dev/vuln/GO-2025-4008 Standard library Found in: crypto/tls@go1.24.6 Fixed in: crypto/tls@go1.24.8 Vulnerable symbols found: #1: tls.Conn.Handshake #2: tls.Conn.HandshakeContext #3: tls.Conn.Read #4: tls.Conn.Write #5: tls.Dial Use '-show traces' to see the other 4 found symbols Vulnerability #9: GO-2025-4007 Quadratic complexity when checking name constraints in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2025-4007 Standard library Found in: crypto/x509@go1.24.6 Fixed in: crypto/x509@go1.24.9 Vulnerable symbols found: #1: x509.CertPool.AppendCertsFromPEM #2: x509.Certificate.CheckCRLSignature #3: x509.Certificate.CheckSignature #4: x509.Certificate.CheckSignatureFrom #5: x509.Certificate.CreateCRL Use '-show traces' to see the other 27 found symbols Vulnerability #10: GO-2025-4006 Excessive CPU consumption in ParseAddress in net/mail More info: https://pkg.go.dev/vuln/GO-2025-4006 Standard library Found in: net/mail@go1.24.6 Fixed in: net/mail@go1.24.8 Vulnerable symbols found: #1: mail.AddressParser.Parse #2: mail.AddressParser.ParseList #3: mail.Header.AddressList #4: mail.ParseAddress #5: mail.ParseAddressList ``` Signed-off-by: Fabiano Fidêncio --- src/runtime/go.mod | 2 +- src/tools/csi-kata-directvolume/go.mod | 4 ++-- src/tools/log-parser/go.mod | 2 +- tests/go.mod | 2 +- tests/metrics/cmd/checkmetrics/go.mod | 2 +- .../cmd/checkmetrics/vendor/golang.org/x/sys/unix/mkerrors.sh | 4 ++-- tools/testing/kata-webhook/go.mod | 2 +- versions.yaml | 4 ++-- 8 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/runtime/go.mod b/src/runtime/go.mod index 7e92144451..3fa64068af 100644 --- a/src/runtime/go.mod +++ b/src/runtime/go.mod @@ -1,7 +1,7 @@ module github.com/kata-containers/kata-containers/src/runtime // Keep in sync with version in versions.yaml -go 1.24.6 +go 1.24.9 // WARNING: Do NOT use `replace` directives as those break dependabot: // https://github.com/kata-containers/kata-containers/issues/11020 diff --git a/src/tools/csi-kata-directvolume/go.mod b/src/tools/csi-kata-directvolume/go.mod index 46fd85a452..b95c9bc5f8 100644 --- a/src/tools/csi-kata-directvolume/go.mod +++ b/src/tools/csi-kata-directvolume/go.mod @@ -1,7 +1,7 @@ module kata-containers/csi-kata-directvolume // Keep in sync with version in versions.yaml -go 1.24.6 +go 1.24.9 // WARNING: Do NOT use `replace` directives as those break dependabot: // https://github.com/kata-containers/kata-containers/issues/11020 @@ -15,6 +15,7 @@ require ( github.com/pborman/uuid v1.2.1 github.com/stretchr/testify v1.8.4 golang.org/x/net v0.38.0 + golang.org/x/sys v0.31.0 google.golang.org/grpc v1.63.2 k8s.io/apimachinery v0.28.2 k8s.io/klog/v2 v2.110.1 @@ -35,7 +36,6 @@ require ( github.com/pmezard/go-difflib v1.0.0 // indirect github.com/sirupsen/logrus v1.9.0 // indirect github.com/ulikunitz/xz v0.5.14 // indirect - golang.org/x/sys v0.31.0 // indirect golang.org/x/text v0.23.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de // indirect google.golang.org/protobuf v1.33.0 // indirect diff --git a/src/tools/log-parser/go.mod b/src/tools/log-parser/go.mod index b68a425210..5b1918b444 100644 --- a/src/tools/log-parser/go.mod +++ b/src/tools/log-parser/go.mod @@ -1,7 +1,7 @@ module github.com/kata-containers/kata-containers/src/tools/log-parser // Keep in sync with version in versions.yaml -go 1.24.6 +go 1.24.9 require ( github.com/BurntSushi/toml v1.1.0 diff --git a/tests/go.mod b/tests/go.mod index ffdd767249..117ce495d3 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -1,7 +1,7 @@ module github.com/kata-containers/tests // Keep in sync with version in versions.yaml -go 1.24.6 +go 1.24.9 // WARNING: Do NOT use `replace` directives as those break dependabot: // https://github.com/kata-containers/kata-containers/issues/11020 diff --git a/tests/metrics/cmd/checkmetrics/go.mod b/tests/metrics/cmd/checkmetrics/go.mod index ff56007084..5637c31aba 100644 --- a/tests/metrics/cmd/checkmetrics/go.mod +++ b/tests/metrics/cmd/checkmetrics/go.mod @@ -1,7 +1,7 @@ module example.com/m // Keep in sync with version in versions.yaml -go 1.24.6 +go 1.24.9 require ( github.com/BurntSushi/toml v1.3.2 diff --git a/tests/metrics/cmd/checkmetrics/vendor/golang.org/x/sys/unix/mkerrors.sh b/tests/metrics/cmd/checkmetrics/vendor/golang.org/x/sys/unix/mkerrors.sh index 0671271cf8..ca50e4e14d 100644 --- a/tests/metrics/cmd/checkmetrics/vendor/golang.org/x/sys/unix/mkerrors.sh +++ b/tests/metrics/cmd/checkmetrics/vendor/golang.org/x/sys/unix/mkerrors.sh @@ -638,7 +638,7 @@ errors=$( signals=$( echo '#include ' | $CC -x c - -E -dM $ccflags | awk '$1=="#define" && $2 ~ /^SIG[A-Z0-9]+$/ { print $2 }' | - grep -v -E '(SIGSTKSIZE|SIGSTKSZ|SIGRT|SIGMAX64)' | + egrep -v '(SIGSTKSIZE|SIGSTKSZ|SIGRT|SIGMAX64)' | sort ) @@ -648,7 +648,7 @@ echo '#include ' | $CC -x c - -E -dM $ccflags | sort >_error.grep echo '#include ' | $CC -x c - -E -dM $ccflags | awk '$1=="#define" && $2 ~ /^SIG[A-Z0-9]+$/ { print "^\t" $2 "[ \t]*=" }' | - grep -v -E '(SIGSTKSIZE|SIGSTKSZ|SIGRT|SIGMAX64)' | + egrep -v '(SIGSTKSIZE|SIGSTKSZ|SIGRT|SIGMAX64)' | sort >_signal.grep echo '// mkerrors.sh' "$@" diff --git a/tools/testing/kata-webhook/go.mod b/tools/testing/kata-webhook/go.mod index 09723965f7..3338dcf926 100644 --- a/tools/testing/kata-webhook/go.mod +++ b/tools/testing/kata-webhook/go.mod @@ -1,7 +1,7 @@ module module-path // Keep in sync with version in versions.yaml -go 1.24.6 +go 1.24.9 require ( github.com/sirupsen/logrus v1.9.3 diff --git a/versions.yaml b/versions.yaml index 24537d17ab..ab7521ac95 100644 --- a/versions.yaml +++ b/versions.yaml @@ -433,12 +433,12 @@ languages: description: "Google's 'go' language" notes: "'version' is the default minimum version used by this project." # When updating this, also update in go.mod files. - version: "1.24.6" + version: "1.24.9" meta: description: | 'newest-version' is the latest version known to work when building Kata - newest-version: "1.24.6" + newest-version: "1.24.9" rust: description: "Rust language"