Cordy/Cairn

Fork 0

govulncheck: reachable vulnerabilities on main #543

New issue

Closed

opened 2026-09-14 05:30:49 +00:00 by forgejo-actions · 1 comment

forgejo-actions commented

2026-09-14 05:30:49 +00:00

The weekly vulncheck workflow found vulnerabilities reachable from our code.

== toolchain pinned by go.mod ==
8644688
go 1.26.0
== patch drift (informational) ==
NOTICE: a newer Go patch exists — go get go@patch would change:
--- /tmp/go.mod.before
+++ go.mod
@@ -1,6 +1,6 @@
 module github.com/nikolasomborski/cairn
 
-go 1.26.0
+go 1.26.8
 
 require (
 	filippo.io/age v1.3.1
== govulncheck (source mode, reachability) ==
      #3: cmd/cairnd/main.go:1454:30: cairnd.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate
      #4: internal/peering/peerpb/peering.pb.go:857:49: peerpb.file_cairn_peer_v1_peering_proto_rawDescGZIP calls sync.Once.Do, which eventually calls template.Template.Funcs
      #5: internal/share/viewer.go:44:60: share.init calls template.Template.Parse
      #6: internal/peering/service.go:359:46: peering.Service.ListReceiverSpaces calls fmt.Sprintf, which eventually calls template.context.String

Vulnerability #21: GO-2026-4603
    URLs in meta content attribute actions are not escaped in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4603
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.1
    Example traces found:
      #1: internal/share/public.go:392:18: share.PublicHandler.renderPasswordForm calls template.Template.Execute
      #2: cmd/cairnd/main.go:1454:30: cairnd.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #22: GO-2026-4602
    FileInfo can escape from a Root in os
  More info: https://pkg.go.dev/vuln/GO-2026-4602
  Standard library
    Found in: os@go1.26
    Fixed in: os@go1.26.1
    Example traces found:
      #1: internal/storage/posix/posix.go:118:28: posix.Driver.List calls fs.ReadDir, which calls os.File.ReadDir
      #2: internal/audit/audit.go:296:25: audit.Logger.QueryWithTotal calls os.ReadDir
      #3: internal/storage/posix/posix.go:118:28: posix.Driver.List calls fs.ReadDir, which calls os.rootFS.ReadDir

Vulnerability #23: GO-2026-4601
    Incorrect parsing of IPv6 host literals in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-4601
  Standard library
    Found in: net/url@go1.26
    Fixed in: net/url@go1.26.1
    Example traces found:
      #1: internal/preview/convert.go:53:25: preview.NewConverter calls url.Parse
      #2: cmd/cairnd/main.go:1454:30: cairnd.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
      #3: internal/ocm/client.go:394:23: ocm.Client.ListRemote calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #24: GO-2026-4600
    Panic in name constraint checking for malformed certificates in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4600
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: internal/storage/s3/s3.go:261:23: s3.object.Read calls http.readWriteCloserBody.Read, which eventually calls x509.Certificate.Verify

Vulnerability #25: GO-2026-4599
    Incorrect enforcement of email constraints in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4599
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: internal/storage/s3/s3.go:261:23: s3.object.Read calls http.readWriteCloserBody.Read, which eventually calls x509.Certificate.Verify

Your code is affected by 25 vulnerabilities from the Go standard library.
This scan also found 5 vulnerabilities in packages you import and 7
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

Fix recipe (#447): go get go@patch on a branch (or bump the affected dependency), full suite green, release, bump dogfoods.

Filed automatically by the scheduled vulncheck workflow.

The weekly vulncheck workflow found vulnerabilities reachable from our code. ``` == toolchain pinned by go.mod == 8644688 go 1.26.0 == patch drift (informational) == NOTICE: a newer Go patch exists — go get go@patch would change: --- /tmp/go.mod.before +++ go.mod @@ -1,6 +1,6 @@ module github.com/nikolasomborski/cairn -go 1.26.0 +go 1.26.8 require ( filippo.io/age v1.3.1 == govulncheck (source mode, reachability) == #3: cmd/cairnd/main.go:1454:30: cairnd.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate #4: internal/peering/peerpb/peering.pb.go:857:49: peerpb.file_cairn_peer_v1_peering_proto_rawDescGZIP calls sync.Once.Do, which eventually calls template.Template.Funcs #5: internal/share/viewer.go:44:60: share.init calls template.Template.Parse #6: internal/peering/service.go:359:46: peering.Service.ListReceiverSpaces calls fmt.Sprintf, which eventually calls template.context.String Vulnerability #21: GO-2026-4603 URLs in meta content attribute actions are not escaped in html/template More info: https://pkg.go.dev/vuln/GO-2026-4603 Standard library Found in: html/template@go1.26 Fixed in: html/template@go1.26.1 Example traces found: #1: internal/share/public.go:392:18: share.PublicHandler.renderPasswordForm calls template.Template.Execute #2: cmd/cairnd/main.go:1454:30: cairnd.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate Vulnerability #22: GO-2026-4602 FileInfo can escape from a Root in os More info: https://pkg.go.dev/vuln/GO-2026-4602 Standard library Found in: os@go1.26 Fixed in: os@go1.26.1 Example traces found: #1: internal/storage/posix/posix.go:118:28: posix.Driver.List calls fs.ReadDir, which calls os.File.ReadDir #2: internal/audit/audit.go:296:25: audit.Logger.QueryWithTotal calls os.ReadDir #3: internal/storage/posix/posix.go:118:28: posix.Driver.List calls fs.ReadDir, which calls os.rootFS.ReadDir Vulnerability #23: GO-2026-4601 Incorrect parsing of IPv6 host literals in net/url More info: https://pkg.go.dev/vuln/GO-2026-4601 Standard library Found in: net/url@go1.26 Fixed in: net/url@go1.26.1 Example traces found: #1: internal/preview/convert.go:53:25: preview.NewConverter calls url.Parse #2: cmd/cairnd/main.go:1454:30: cairnd.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI #3: internal/ocm/client.go:394:23: ocm.Client.ListRemote calls http.Client.Do, which eventually calls url.URL.Parse Vulnerability #24: GO-2026-4600 Panic in name constraint checking for malformed certificates in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2026-4600 Standard library Found in: crypto/x509@go1.26 Fixed in: crypto/x509@go1.26.1 Example traces found: #1: internal/storage/s3/s3.go:261:23: s3.object.Read calls http.readWriteCloserBody.Read, which eventually calls x509.Certificate.Verify Vulnerability #25: GO-2026-4599 Incorrect enforcement of email constraints in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2026-4599 Standard library Found in: crypto/x509@go1.26 Fixed in: crypto/x509@go1.26.1 Example traces found: #1: internal/storage/s3/s3.go:261:23: s3.object.Read calls http.readWriteCloserBody.Read, which eventually calls x509.Certificate.Verify Your code is affected by 25 vulnerabilities from the Go standard library. This scan also found 5 vulnerabilities in packages you import and 7 vulnerabilities in modules you require, but your code doesn't appear to call these vulnerabilities. Use '-show verbose' for more details. ``` Fix recipe (#447): `go get go@patch` on a branch (or bump the affected dependency), full suite green, release, bump dogfoods. --- Filed automatically by the scheduled vulncheck workflow.

Cordy added this to the v0.7 — Closed beta (dogfood + hardening) milestone

2026-09-14 18:14:08 +00:00

Cordy referenced this issue from a commit

2026-09-16 01:24:08 +00:00

ci: one-shot go@patch bump for #543

Cordy referenced this issue from a commit

2026-09-16 01:24:55 +00:00

ci: fix two defects in the #543 one-shot before dispatch

Cordy referenced this issue from a commit

2026-09-16 01:28:50 +00:00

ci: #543 also bump grpc to v1.83.1 (reachable after the stdlib patch)

forgejo-actions referenced this issue from a commit

2026-09-16 01:29:36 +00:00

chore(#543): go@patch + grpc v1.83.1 - clear reachable vulnerabilities (v0.6.207)

forgejo-actions referenced this issue from a commit

2026-09-16 01:32:30 +00:00

docs(#543): CHANGELOG v0.6.207 entry in house style

Cordy referenced this issue from a pull request that will close it,

2026-09-16 01:33:36 +00:00

#543: clear reachable vulnerabilities — go 1.26.8 + grpc v1.83.1 (v0.6.207) #560

Cordy closed this issue

2026-09-16 01:35:26 +00:00

Cordy referenced this issue from a commit

2026-09-16 01:35:27 +00:00

Merge pull request '#543: clear reachable vulnerabilities — go 1.26.8 + grpc v1.83.1 (v0.6.207)' (#560) from fix-543 into main

Cordy commented

2026-09-16 01:42:29 +00:00

Owner

Fixed — v0.6.207 (PR #560), live on both dogfoods.

go get go@patch moved the go directive 1.26.0 → 1.26.8, clearing all 25 standard-library advisories: html/template escaping, os FileInfo escaping a Root (POSIX driver List, audit reader), net/url IPv6 host-literal parsing, and the two crypto/x509 issues reached through the S3 driver's TLS handshake.

The scan then found a second layer. With the stdlib traces gone, govulncheck surfaced google.golang.org/grpc@v1.83.0 in the transport, reachable from peering.Client.ReceiverSpaces and from the peering gRPC server in gatePeering — 16 traces. The one-shot's guard refused to commit on a non-clean scan, so it failed rather than shipping a half-fix, and the release carries both bumps: grpc → v1.83.1.

Worth writing down for the next time this fires: a vulnerability report is a stack, not a list. Fixing the top layer can reveal the one beneath it, so "the reported CVEs are gone" is not the same as "the scanner is clean". The success condition has to be govulncheck's own verdict, asserted, not the disappearance of the specific IDs in the issue body. The #447 recipe should be read that way.

Verification (all on the runner, before the commit): go build ./... and go vet ./... clean, full go test ./... green, govulncheck ./... → "Your code is affected by 0 vulnerabilities", asserted as a hard gate.

No Cairn source changed — go.mod, go.sum, CHANGELOG.md only. The ko release build picked up 1.26.8 with no workflow change, since release already bootstraps go1.22.5 and lets GOTOOLCHAIN=auto fetch whatever go.mod names. Both pods booted clean on version=v0.6.207.

**Fixed — v0.6.207 (PR #560), live on both dogfoods.** `go get go@patch` moved the `go` directive **1.26.0 → 1.26.8**, clearing all 25 standard-library advisories: `html/template` escaping, `os` FileInfo escaping a `Root` (POSIX driver `List`, audit reader), `net/url` IPv6 host-literal parsing, and the two `crypto/x509` issues reached through the S3 driver's TLS handshake. **The scan then found a second layer.** With the stdlib traces gone, govulncheck surfaced `google.golang.org/grpc@v1.83.0` in the transport, reachable from `peering.Client.ReceiverSpaces` and from the peering gRPC server in `gatePeering` — 16 traces. The one-shot's guard refused to commit on a non-clean scan, so it failed rather than shipping a half-fix, and the release carries both bumps: grpc → **v1.83.1**. Worth writing down for the next time this fires: **a vulnerability report is a stack, not a list.** Fixing the top layer can reveal the one beneath it, so "the reported CVEs are gone" is not the same as "the scanner is clean". The success condition has to be govulncheck's own verdict, asserted, not the disappearance of the specific IDs in the issue body. The #447 recipe should be read that way. **Verification** (all on the runner, before the commit): `go build ./...` and `go vet ./...` clean, full `go test ./...` green, `govulncheck ./...` → *"Your code is affected by 0 vulnerabilities"*, asserted as a hard gate. No Cairn source changed — `go.mod`, `go.sum`, `CHANGELOG.md` only. The ko release build picked up 1.26.8 with no workflow change, since release already bootstraps go1.22.5 and lets `GOTOOLCHAIN=auto` fetch whatever `go.mod` names. Both pods booted clean on `version=v0.6.207`.

No labels

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#543

No description provided.

Rows
Columns