mirror of
https://github.com/k3s-io/kubernetes.git
synced 2026-07-20 16:19:33 +00:00
c825d80bbf
This PR updates security-critical dependencies addressing authentication
and data parsing vulnerabilities.
**Authentication Security:**
- github.com/coreos/go-oidc: v2.3.0 -> v2.5.0
- Security fix: Now verifies token signature BEFORE validating payload
- Prevents potential processing of tampered tokens before cryptographic
verification
- github.com/cyphar/filepath-securejoin: v0.6.0 -> v0.6.1
- Security fix: Fixed seccomp fallback logic - library now properly falls
back to safer O_PATH resolver when openat2(2) is denied by seccomp-bpf
- Fixed file descriptor leak in openat2 wrapper during RESOLVE_IN_ROOT
- cyphar.com/go-pathrs: v0.2.1 -> v0.2.2
- Companion update to filepath-securejoin
**Protobuf Security:**
- google.golang.org/protobuf: v1.36.8 -> v1.36.11
- Security fix: Added recursion limit check in lazy decoding validation
- Prevents potential stack exhaustion attacks via maliciously crafted
protobuf messages
- Also adds support for URL chars in type URLs in text-format
These updates are critical for:
- OIDC authentication in kube-apiserver
- Container filesystem path resolution (used by container runtimes)
- Protobuf message parsing throughout the codebase
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
go-oidc
OpenID Connect support for Go
This package enables OpenID Connect support for the golang.org/x/oauth2 package.
provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
if err != nil {
// handle error
}
// Configure an OpenID Connect aware OAuth2 client.
oauth2Config := oauth2.Config{
ClientID: clientID,
ClientSecret: clientSecret,
RedirectURL: redirectURL,
// Discovery returns the OAuth2 endpoints.
Endpoint: provider.Endpoint(),
// "openid" is a required scope for OpenID Connect flows.
Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
}
OAuth2 redirects are unchanged.
func handleRedirect(w http.ResponseWriter, r *http.Request) {
http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
}
The on responses, the provider can be used to verify ID Tokens.
var verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
func handleOAuth2Callback(w http.ResponseWriter, r *http.Request) {
// Verify state and errors.
oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
if err != nil {
// handle error
}
// Extract the ID Token from OAuth2 token.
rawIDToken, ok := oauth2Token.Extra("id_token").(string)
if !ok {
// handle missing token
}
// Parse and verify ID Token payload.
idToken, err := verifier.Verify(ctx, rawIDToken)
if err != nil {
// handle error
}
// Extract custom claims
var claims struct {
Email string `json:"email"`
Verified bool `json:"email_verified"`
}
if err := idToken.Claims(&claims); err != nil {
// handle error
}
}