From 185f65fbddb5239666c0c67fb335589b7570f60c Mon Sep 17 00:00:00 2001 From: Navid Shaikh Date: Thu, 6 May 2021 15:41:08 +0530 Subject: [PATCH] Bump containernetworking/cni to v0.8.1 Fix CVE-2021-20206 --- go.mod | 4 ++-- go.sum | 4 ++-- vendor/github.com/containernetworking/cni/pkg/invoke/find.go | 5 +++++ vendor/modules.txt | 4 ++-- 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 2b7704f8c4e..9a13ec23f66 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/boltdb/bolt v1.3.1 // indirect github.com/clusterhq/flocker-go v0.0.0-20160920122132-2b8b7259d313 github.com/container-storage-interface/spec v1.3.0 - github.com/containernetworking/cni v0.8.0 + github.com/containernetworking/cni v0.8.1 github.com/coredns/corefile-migration v1.0.11 github.com/coreos/go-oidc v2.1.0+incompatible github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e @@ -209,7 +209,7 @@ replace ( github.com/containerd/go-runc => github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3 github.com/containerd/ttrpc => github.com/containerd/ttrpc v1.0.2 github.com/containerd/typeurl => github.com/containerd/typeurl v1.0.1 - github.com/containernetworking/cni => github.com/containernetworking/cni v0.8.0 + github.com/containernetworking/cni => github.com/containernetworking/cni v0.8.1 github.com/coredns/corefile-migration => github.com/coredns/corefile-migration v1.0.11 github.com/coreos/bbolt => github.com/coreos/bbolt v1.3.2 github.com/coreos/etcd => github.com/coreos/etcd v3.3.13+incompatible diff --git a/go.sum b/go.sum index e6b235b5262..e928f3c32e2 100644 --- a/go.sum +++ b/go.sum @@ -108,8 +108,8 @@ github.com/containerd/ttrpc v1.0.2 h1:2/O3oTZN36q2xRolk0a2WWGgh7/Vf/liElg5hFYLX9 github.com/containerd/ttrpc v1.0.2/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y= github.com/containerd/typeurl v1.0.1 h1:PvuK4E3D5S5q6IqsPDCy928FhP0LUIGcmZ/Yhgp5Djw= github.com/containerd/typeurl v1.0.1/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg= -github.com/containernetworking/cni v0.8.0 h1:BT9lpgGoH4jw3lFC7Odz2prU5ruiYKcgAjMCbgybcKI= -github.com/containernetworking/cni v0.8.0/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY= +github.com/containernetworking/cni v0.8.1 h1:7zpDnQ3T3s4ucOuJ/ZCLrYBxzkg0AELFfII3Epo9TmI= +github.com/containernetworking/cni v0.8.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY= github.com/coredns/corefile-migration v1.0.11 h1:ptBYGW2ADXIB7ZEBPrhhTvNwJLQfxE3Q9IUMBhJCEeI= github.com/coredns/corefile-migration v1.0.11/go.mod h1:RMy/mXdeDlYwzt0vdMEJvT2hGJ2I86/eO0UdXmH9XNI= github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk= diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/find.go b/vendor/github.com/containernetworking/cni/pkg/invoke/find.go index e815404c859..e62029eb788 100644 --- a/vendor/github.com/containernetworking/cni/pkg/invoke/find.go +++ b/vendor/github.com/containernetworking/cni/pkg/invoke/find.go @@ -18,6 +18,7 @@ import ( "fmt" "os" "path/filepath" + "strings" ) // FindInPath returns the full path of the plugin by searching in the provided path @@ -26,6 +27,10 @@ func FindInPath(plugin string, paths []string) (string, error) { return "", fmt.Errorf("no plugin name provided") } + if strings.ContainsRune(plugin, os.PathSeparator) { + return "", fmt.Errorf("invalid plugin name: %s", plugin) + } + if len(paths) == 0 { return "", fmt.Errorf("no paths provided") } diff --git a/vendor/modules.txt b/vendor/modules.txt index fbb99d5217c..8d71da49e16 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -187,7 +187,7 @@ github.com/containerd/containerd/pkg/dialer github.com/containerd/containerd/platforms # github.com/containerd/ttrpc v1.0.2 => github.com/containerd/ttrpc v1.0.2 github.com/containerd/ttrpc -# github.com/containernetworking/cni v0.8.0 => github.com/containernetworking/cni v0.8.0 +# github.com/containernetworking/cni v0.8.1 => github.com/containernetworking/cni v0.8.1 ## explicit github.com/containernetworking/cni/libcni github.com/containernetworking/cni/pkg/invoke @@ -2395,7 +2395,7 @@ sigs.k8s.io/yaml # github.com/containerd/go-runc => github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3 # github.com/containerd/ttrpc => github.com/containerd/ttrpc v1.0.2 # github.com/containerd/typeurl => github.com/containerd/typeurl v1.0.1 -# github.com/containernetworking/cni => github.com/containernetworking/cni v0.8.0 +# github.com/containernetworking/cni => github.com/containernetworking/cni v0.8.1 # github.com/coredns/corefile-migration => github.com/coredns/corefile-migration v1.0.11 # github.com/coreos/bbolt => github.com/coreos/bbolt v1.3.2 # github.com/coreos/etcd => github.com/coreos/etcd v3.3.13+incompatible