From ff9840670032d1d3238f5bb6df98fc6f14f411f4 Mon Sep 17 00:00:00 2001 From: Ronan Mac Fhlannchadha Date: Wed, 13 May 2026 16:08:45 +1000 Subject: [PATCH 1/4] [docker-ptf] re-add gnmic, built from openconfig/gnmic main PR #27059 removed gnmic because three CVEs in v0.45.0's deps couldn't be patched cleanly via `go get @latest` overrides. Those dependency fixes have since landed on openconfig/gnmic main. Build from a pinned main commit (71878d1936327b96883488d5f7a7584b1dda9bf1) so docker-ptf has gnmic available again for gNMI testing while we wait for the next tagged release. Signed-off-by: Ronan Mac Fhlannchadha --- dockers/docker-ptf/Dockerfile.j2 | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dockers/docker-ptf/Dockerfile.j2 b/dockers/docker-ptf/Dockerfile.j2 index 3892b31d58f..5f0a691624f 100644 --- a/dockers/docker-ptf/Dockerfile.j2 +++ b/dockers/docker-ptf/Dockerfile.j2 @@ -411,6 +411,17 @@ RUN cd gnxi \ # Deactivating a virtualenv. # ENV PATH="$BACKUP_OF_PATH" +# Build gnmic from source at a pinned upstream main commit. Picks up the +# dependency fixes merged after v0.45.0 (grpc 1.79.3, otel-sdk 1.43.0, +# go-git 5.19.0, etc.) that address the CVEs which forced removal in +# #27059. Temporary until the next tagged gnmic release ships. +RUN GNMIC_REV=71878d1936327b96883488d5f7a7584b1dda9bf1 \ + && git clone https://github.com/openconfig/gnmic.git /tmp/gnmic \ + && cd /tmp/gnmic \ + && git checkout "${GNMIC_REV}" \ + && go build -o /usr/local/bin/gnmic . \ + && chmod +x /usr/local/bin/gnmic \ + && rm -rf /tmp/gnmic /root/go/pkg/mod /root/.cache/go-build # Remove Go toolchain to reduce image size RUN rm -rf /usr/local/go "$(go env GOPATH 2>/dev/null || echo $HOME/go)" From 28c32f1d4f39045629562a2ec62fd97557ca5fe1 Mon Sep 17 00:00:00 2001 From: Ronan Mac Fhlannchadha Date: Thu, 14 May 2026 17:21:14 +1000 Subject: [PATCH 2/4] [docker-ptf] bump Go to 1.25.10 for May 2026 stdlib CVEs Go 1.25.10 is the 2026-05-07 stdlib security release (golang-announce qcCIEXso47M). It closes five DoS/crash CVEs present in 1.25.9, all of which currently compile into the docker-ptf grpcurl, gnoic and gnmic binaries: - CVE-2026-33811 net.LookupCNAME double-free (cgo resolver) - CVE-2026-33814 net/http HTTP/2 SETTINGS_MAX_FRAME_SIZE=0 DoS (the most relevant for these gRPC binaries) - CVE-2026-39820 net/mail.ParseAddress / ParseDate DoS - CVE-2026-39836 net.Dial / LookupPort panic on Windows - CVE-2026-42499 net/mail.consumePhrase DoS x86_64 / arm64 / armv6l Go tarball SHA256s taken from https://go.dev/dl/?mode=json on 2026-05-14. Signed-off-by: Ronan Mac Fhlannchadha --- dockers/docker-ptf/Dockerfile.j2 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dockers/docker-ptf/Dockerfile.j2 b/dockers/docker-ptf/Dockerfile.j2 index 5f0a691624f..daa72e20a8e 100644 --- a/dockers/docker-ptf/Dockerfile.j2 +++ b/dockers/docker-ptf/Dockerfile.j2 @@ -107,15 +107,15 @@ RUN apt-get update \ # to ensure they use a patched Go stdlib (GO-2026-4337: crypto/tls) {% if CONFIGURED_ARCH == "armhf" %} RUN GO_ARCH=armv6l \ - && GO_SHA256=7d4f0d266d871301e08ef4ac31c56e66048688893b2848392e5c600276351ee8 \ + && GO_SHA256=39f168f158e693887d3ad006168af1b1a3007b19c5993cae4d9d57f82f52aaf8 \ {% elif CONFIGURED_ARCH == "arm64" %} RUN GO_ARCH=arm64 \ - && GO_SHA256=ec342e7389b7f489564ed5463c63b16cf8040023dabc7861256677165a8c0e2b \ + && GO_SHA256=654da1f9b50a5d1c2a85ccf8ed405aa89c06e94d18384628bf186f7712677b08 \ {% else %} RUN GO_ARCH=amd64 \ - && GO_SHA256=00859d7bd6defe8bf84d9db9e57b9a4467b2887c18cd93ae7460e713db774bc1 \ + && GO_SHA256=42d4f7a32316aa66591eca7e89867256057a4264451aca10570a715b3637ba70 \ {% endif %} - && GO_VERSION=1.25.9 \ + && GO_VERSION=1.25.10 \ && curl -L "https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" -o /tmp/go.tar.gz \ && echo "${GO_SHA256} /tmp/go.tar.gz" | sha256sum -c - \ && tar -C /usr/local -xzf /tmp/go.tar.gz \ From f2ea88c2fce9126579635be6f385f915e18ddcad Mon Sep 17 00:00:00 2001 From: Ronan Mac Fhlannchadha Date: Thu, 14 May 2026 17:25:33 +1000 Subject: [PATCH 3/4] [docker-ptf] bump bundled prometheus to v0.311.3 in gnmic build Closes CVE-2026-42151 / GHSA-wg65-39gg-5wfj (HIGH, CVSS 7.5): Prometheus < v0.311.3 exposes Azure AD OAuth client secrets in plaintext via the config API. Fixed only in v0.311.3. Upstream gnmic main still pins prometheus v0.311.2 at SHA 71878d19. Add a single 'go get github.com/prometheus/prometheus@v0.311.3' override to the from-source build so the docker-ptf gnmic binary picks up the fix without waiting on an upstream gnmic release. Once the corresponding gnmic upstream PR (openconfig/gnmic#872) merges and we move the pinned SHA forward, this override line becomes redundant and can be removed. Signed-off-by: Ronan Mac Fhlannchadha --- dockers/docker-ptf/Dockerfile.j2 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dockers/docker-ptf/Dockerfile.j2 b/dockers/docker-ptf/Dockerfile.j2 index daa72e20a8e..6707d8ba974 100644 --- a/dockers/docker-ptf/Dockerfile.j2 +++ b/dockers/docker-ptf/Dockerfile.j2 @@ -415,10 +415,14 @@ RUN cd gnxi \ # dependency fixes merged after v0.45.0 (grpc 1.79.3, otel-sdk 1.43.0, # go-git 5.19.0, etc.) that address the CVEs which forced removal in # #27059. Temporary until the next tagged gnmic release ships. +# prometheus is pinned forward to v0.311.3 to close CVE-2026-42151 +# (Azure AD OAuth client secret exposed via config API); upstream gnmic +# still pins v0.311.2 at the SHA above. RUN GNMIC_REV=71878d1936327b96883488d5f7a7584b1dda9bf1 \ && git clone https://github.com/openconfig/gnmic.git /tmp/gnmic \ && cd /tmp/gnmic \ && git checkout "${GNMIC_REV}" \ + && go get github.com/prometheus/prometheus@v0.311.3 \ && go build -o /usr/local/bin/gnmic . \ && chmod +x /usr/local/bin/gnmic \ && rm -rf /tmp/gnmic /root/go/pkg/mod /root/.cache/go-build From 37a0c2c02af8e9e181dc4828e605c8d75c879ba8 Mon Sep 17 00:00:00 2001 From: Ronan Mac Fhlannchadha Date: Fri, 15 May 2026 06:52:31 +1000 Subject: [PATCH 4/4] [docker-ptf] move gnmic pin past openconfig/gnmic#872, drop prometheus override openconfig/gnmic PR #872 (Go 1.25.10 + prometheus v0.311.3) merged upstream at SHA 653dc5dd4ddcd3bd4197317875a10c1ce8b06653. Move the pinned commit to that merge SHA and remove the local 'go get github.com/prometheus/prometheus@v0.311.3' override, which is now redundant since v0.311.3 is in gnmic's own go.mod. No change in the resulting binary's prometheus or Go stdlib version; this just collapses the from-source build back to a single git checkout + go build with no dependency overrides. Signed-off-by: Ronan Mac Fhlannchadha --- dockers/docker-ptf/Dockerfile.j2 | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/dockers/docker-ptf/Dockerfile.j2 b/dockers/docker-ptf/Dockerfile.j2 index 6707d8ba974..d726b210f1e 100644 --- a/dockers/docker-ptf/Dockerfile.j2 +++ b/dockers/docker-ptf/Dockerfile.j2 @@ -413,16 +413,13 @@ RUN cd gnxi \ # Build gnmic from source at a pinned upstream main commit. Picks up the # dependency fixes merged after v0.45.0 (grpc 1.79.3, otel-sdk 1.43.0, -# go-git 5.19.0, etc.) that address the CVEs which forced removal in -# #27059. Temporary until the next tagged gnmic release ships. -# prometheus is pinned forward to v0.311.3 to close CVE-2026-42151 -# (Azure AD OAuth client secret exposed via config API); upstream gnmic -# still pins v0.311.2 at the SHA above. -RUN GNMIC_REV=71878d1936327b96883488d5f7a7584b1dda9bf1 \ +# go-git 5.19.0, prometheus 0.311.3, etc.) that address the CVEs which +# forced removal in #27059. Temporary until the next tagged gnmic +# release ships. +RUN GNMIC_REV=653dc5dd4ddcd3bd4197317875a10c1ce8b06653 \ && git clone https://github.com/openconfig/gnmic.git /tmp/gnmic \ && cd /tmp/gnmic \ && git checkout "${GNMIC_REV}" \ - && go get github.com/prometheus/prometheus@v0.311.3 \ && go build -o /usr/local/bin/gnmic . \ && chmod +x /usr/local/bin/gnmic \ && rm -rf /tmp/gnmic /root/go/pkg/mod /root/.cache/go-build