Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CVE-2023-47108 in go.opentelemetry.io #742

Merged
merged 1 commit into from
May 20, 2024
Merged

Fix CVE-2023-47108 in go.opentelemetry.io #742

merged 1 commit into from
May 20, 2024

Conversation

jgu17
Copy link
Contributor

@jgu17 jgu17 commented May 17, 2024 •
edited by Huang-Wei

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fix CVE-2023-47108 in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0

Which issue(s) this PR fixes:

Fixes #741

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Fix https://github.com/advisories/GHSA-8pgv-569h-w5rw in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/bug Categorizes issue or PR as related to a bug. labels May 17, 2024
@linux-foundation-easycla Linux Foundation: EasyCLA
Copy link

linux-foundation-easycla bot commented May 17, 2024 •
edited

CLA Signed

The committers listed above are authorized under a signed CLA.

@k8s-ci-robot k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 17, 2024
@k8s-ci-robot
Copy link
Contributor

Hi @jgu17. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@netlify Netlify
Copy link

netlify bot commented May 17, 2024 •
edited

✅ Deploy Preview for kubernetes-sigs-scheduler-plugins canceled.

Name Link
🔨 Latest commit 3ed401c
🔍 Latest deploy log https://app.netlify.com/sites/kubernetes-sigs-scheduler-plugins/deploys/664bc2d91238f600084b461c

@k8s-ci-robot k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 17, 2024
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels May 17, 2024
@Huang-Wei
Copy link
Contributor

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 17, 2024
@Huang-Wei
Copy link
Contributor

@jgu17 please append a commit w/ all vendor/ changes.

@k8s-ci-robot k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 20, 2024
@jgu17
Copy link
Contributor Author

jgu17 commented May 20, 2024

@jgu17 please append a commit w/ all vendor/ changes.

Sounds good, included the changes from go mod vendor. @Huang-Wei

@Huang-Wei
Copy link
Contributor

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 20, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Huang-Wei, jgu17

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels May 20, 2024
@k8s-ci-robot k8s-ci-robot merged commit ab04632 into kubernetes-sigs:master May 20, 2024
10 checks passed
@Huang-Wei
Copy link
Contributor

/cherrypick release-1.28

@k8s-infra-cherrypick-robot
Copy link

@Huang-Wei: #742 failed to apply on top of branch "release-1.28":

Applying: Fix CVE-2023-47108 in go.opentelemetry.io
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
A	vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/config.go
M	vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
M	vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/parse.go
A	vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.go
M	vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.go
M	vendor/go.opentelemetry.io/otel/.gitignore
M	vendor/go.opentelemetry.io/otel/.golangci.yml
M	vendor/go.opentelemetry.io/otel/CHANGELOG.md
M	vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
M	vendor/go.opentelemetry.io/otel/Makefile
M	vendor/go.opentelemetry.io/otel/README.md
M	vendor/go.opentelemetry.io/otel/baggage/baggage.go
M	vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.md
M	vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go
M	vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go
A	vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go
A	vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go
M	vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go
A	vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go
A	vendor/go.opentelemetry.io/otel/internal/global/instruments.go
M	vendor/go.opentelemetry.io/otel/metric/doc.go
A	vendor/go.opentelemetry.io/otel/metric/instrument.go
A	vendor/go.opentelemetry.io/otel/metric/syncfloat64.go
A	vendor/go.opentelemetry.io/otel/metric/syncint64.go
A	vendor/go.opentelemetry.io/otel/requirements.txt
M	vendor/go.opentelemetry.io/otel/sdk/resource/auto.go
M	vendor/go.opentelemetry.io/otel/sdk/resource/env.go
M	vendor/go.opentelemetry.io/otel/sdk/resource/os.go
M	vendor/go.opentelemetry.io/otel/sdk/resource/process.go
M	vendor/go.opentelemetry.io/otel/sdk/trace/provider.go
M	vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go
M	vendor/go.opentelemetry.io/otel/sdk/trace/span.go
M	vendor/go.opentelemetry.io/otel/sdk/trace/tracer.go
A	vendor/go.opentelemetry.io/otel/sdk/version.go
M	vendor/go.opentelemetry.io/otel/trace/config.go
M	vendor/go.opentelemetry.io/otel/trace/doc.go
M	vendor/go.opentelemetry.io/otel/trace/noop.go
M	vendor/go.opentelemetry.io/otel/trace/trace.go
M	vendor/go.opentelemetry.io/otel/version.go
M	vendor/go.opentelemetry.io/otel/versions.yaml
M	vendor/google.golang.org/grpc/README.md
M	vendor/google.golang.org/grpc/attributes/attributes.go
M	vendor/google.golang.org/grpc/balancer/balancer.go
M	vendor/google.golang.org/grpc/clientconn.go
M	vendor/google.golang.org/grpc/dialoptions.go
M	vendor/google.golang.org/grpc/encoding/encoding.go
M	vendor/google.golang.org/grpc/internal/internal.go
M	vendor/google.golang.org/grpc/internal/status/status.go
M	vendor/google.golang.org/grpc/internal/transport/http2_client.go
M	vendor/google.golang.org/grpc/internal/transport/http2_server.go.git/rebase-apply/patch:1607: trailing whitespace.
lint-markdown: 
.git/rebase-apply/patch:4191: trailing whitespace.
not git grep "\(import \|^\s*\)\"google.golang.org/grpc/interop/grpc_testing" -- "*.go" 
warning: 2 lines add whitespace errors.

M	vendor/google.golang.org/grpc/internal/transport/http_util.go
M	vendor/google.golang.org/grpc/internal/transport/transport.go
M	vendor/google.golang.org/grpc/resolver/manual/manual.go
M	vendor/google.golang.org/grpc/server.go
M	vendor/google.golang.org/grpc/version.go
M	vendor/google.golang.org/grpc/vet.sh
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Auto-merging vendor/google.golang.org/grpc/vet.sh
Auto-merging vendor/google.golang.org/grpc/version.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/version.go
Auto-merging vendor/google.golang.org/grpc/server.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/server.go
Auto-merging vendor/google.golang.org/grpc/resolver/manual/manual.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/resolver/manual/manual.go
Auto-merging vendor/google.golang.org/grpc/internal/transport/transport.go
Auto-merging vendor/google.golang.org/grpc/internal/transport/http_util.go
Auto-merging vendor/google.golang.org/grpc/internal/transport/http2_server.go
Auto-merging vendor/google.golang.org/grpc/internal/transport/http2_client.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/internal/transport/http2_client.go
Auto-merging vendor/google.golang.org/grpc/internal/status/status.go
Auto-merging vendor/google.golang.org/grpc/internal/internal.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/internal/internal.go
Auto-merging vendor/google.golang.org/grpc/encoding/encoding.go
Auto-merging vendor/google.golang.org/grpc/dialoptions.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/dialoptions.go
Auto-merging vendor/google.golang.org/grpc/clientconn.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/clientconn.go
Auto-merging vendor/google.golang.org/grpc/balancer/balancer.go
Auto-merging vendor/google.golang.org/grpc/attributes/attributes.go
CONFLICT (content): Merge conflict in vendor/google.golang.org/grpc/attributes/attributes.go
Auto-merging vendor/google.golang.org/grpc/README.md
Auto-merging vendor/go.opentelemetry.io/otel/versions.yaml
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/versions.yaml
Auto-merging vendor/go.opentelemetry.io/otel/version.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/version.go
Auto-merging vendor/go.opentelemetry.io/otel/trace/trace.go
Auto-merging vendor/go.opentelemetry.io/otel/trace/noop.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/trace/noop.go
Auto-merging vendor/go.opentelemetry.io/otel/trace/doc.go
Auto-merging vendor/go.opentelemetry.io/otel/trace/config.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/trace/tracer.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/trace/span.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/trace/provider.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/sdk/trace/provider.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/resource/process.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/resource/os.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/resource/env.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/sdk/resource/env.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/resource/auto.go
Auto-merging vendor/go.opentelemetry.io/otel/sdk/instrumentation/library.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/sdk/instrumentation/library.go
CONFLICT (modify/delete): vendor/go.opentelemetry.io/otel/requirements.txt deleted in HEAD and modified in Fix CVE-2023-47108 in go.opentelemetry.io. Version Fix CVE-2023-47108 in go.opentelemetry.io of vendor/go.opentelemetry.io/otel/requirements.txt left in tree.
CONFLICT (modify/delete): vendor/go.opentelemetry.io/otel/metric/syncint64.go deleted in HEAD and modified in Fix CVE-2023-47108 in go.opentelemetry.io. Version Fix CVE-2023-47108 in go.opentelemetry.io of vendor/go.opentelemetry.io/otel/metric/syncint64.go left in tree.
CONFLICT (modify/delete): vendor/go.opentelemetry.io/otel/metric/syncfloat64.go deleted in HEAD and modified in Fix CVE-2023-47108 in go.opentelemetry.io. Version Fix CVE-2023-47108 in go.opentelemetry.io of vendor/go.opentelemetry.io/otel/metric/syncfloat64.go left in tree.
CONFLICT (modify/delete): vendor/go.opentelemetry.io/otel/metric/instrument.go deleted in HEAD and modified in Fix CVE-2023-47108 in go.opentelemetry.io. Version Fix CVE-2023-47108 in go.opentelemetry.io of vendor/go.opentelemetry.io/otel/metric/instrument.go left in tree.
Auto-merging vendor/go.opentelemetry.io/otel/metric/doc.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/metric/doc.go
CONFLICT (modify/delete): vendor/go.opentelemetry.io/otel/internal/global/instruments.go deleted in HEAD and modified in Fix CVE-2023-47108 in go.opentelemetry.io. Version Fix CVE-2023-47108 in go.opentelemetry.io of vendor/go.opentelemetry.io/otel/internal/global/instruments.go left in tree.
Auto-merging vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go
Auto-merging vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go
Auto-merging vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/options.go
Auto-merging vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go
CONFLICT (modify/delete): vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.md deleted in Fix CVE-2023-47108 in go.opentelemetry.io and modified in HEAD. Version HEAD of vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.md left in tree.
Auto-merging vendor/go.opentelemetry.io/otel/exporters/otlp/internal/envconfig/envconfig.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/exporters/otlp/internal/envconfig/envconfig.go
Auto-merging vendor/go.opentelemetry.io/otel/baggage/baggage.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/baggage/baggage.go
Auto-merging vendor/go.opentelemetry.io/otel/attribute/doc.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/attribute/doc.go
Auto-merging vendor/go.opentelemetry.io/otel/README.md
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/README.md
Auto-merging vendor/go.opentelemetry.io/otel/Makefile
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/Makefile
Auto-merging vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
Auto-merging vendor/go.opentelemetry.io/otel/CHANGELOG.md
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/CHANGELOG.md
Auto-merging vendor/go.opentelemetry.io/otel/.golangci.yml
Auto-merging vendor/go.opentelemetry.io/otel/.gitignore
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/otel/.gitignore
Auto-merging vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.go
CONFLICT (modify/delete): vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.go deleted in HEAD and modified in Fix CVE-2023-47108 in go.opentelemetry.io. Version Fix CVE-2023-47108 in go.opentelemetry.io of vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.go left in tree.
Auto-merging vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/parse.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/parse.go
Auto-merging vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
Auto-merging vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/grpctrace.go
CONFLICT (content): Merge conflict in vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/grpctrace.go
Removing vendor/github.com/google/uuid/.travis.yml
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Fix CVE-2023-47108 in go.opentelemetry.io
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherrypick release-1.28

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@jgu17
Copy link
Contributor Author

jgu17 commented May 20, 2024

/cherrypick release-1.28

@k8s-infra-cherrypick-robot
Copy link

@jgu17: only kubernetes-sigs org members may request cherry picks. If you are already part of the org, make sure to change your membership to public. Otherwise you can still do the cherry-pick manually.

In response to this:

/cherrypick release-1.28

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@jgu17
Copy link
Contributor Author

jgu17 commented May 20, 2024

@Huang-Wei Many thanks for reviewing. Could I ask another favor to cherry pick to 1.28? it doesn't look I have earned the permission to do so yet :-)

@Huang-Wei
Copy link
Contributor

This PR cannot be automatically cherrypicked (due to vendor/ changes). I will manually do that.

@Huang-Wei
Copy link
Contributor

@jgu17 it seems the go.mod changes for master is incompatible w/ release-1.28. Could you raise a PR to release-1.28 to manually resolves the dependency issue?

@jgu17
Copy link
Contributor Author

jgu17 commented May 21, 2024

@jgu17 it seems the go.mod changes for master is incompatible w/ release-1.28. Could you raise a PR to release-1.28 to manually resolves the dependency issue?

will do

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@PiotrProkop PiotrProkop Awaiting requested review from PiotrProkop

@Tal-or Tal-or Awaiting requested review from Tal-or

Assignees

@Huang-Wei Huang-Wei

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Fix CVE-2023-47108 in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0
4 participants
@jgu17 @k8s-ci-robot @Huang-Wei @k8s-infra-cherrypick-robot