Skip to content

fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs - #742

Closed
qiluo-msft wants to merge 6 commits into
masterfrom
fix/cve-gnmi-rebase-2026-08
Closed

fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs#742
qiluo-msft wants to merge 6 commits into
masterfrom
fix/cve-gnmi-rebase-2026-08

Conversation

@qiluo-msft

@qiluo-msft qiluo-msft commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Why I did it

Trivy CVE scan identified multiple CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-gnmi.

How I did it

Updated go.mod, Makefile, and regenerated go.sum via go mod tidy with the following version bumps:

Package Old New CVEs Fixed
google.golang.org/grpc v1.69.2 v1.82.1 CVE-2026-33186, GHSA-hrxh-6v49-42gf
golang.org/x/crypto v0.36.0 v0.52.0 CVE-2024-45337, CVE-2025-22869, CVE-2025-47913, CVE-2026-39828–39832
golang.org/x/net v0.38.0 v0.55.0 CVE-2023-39325, CVE-2023-45288, CVE-2024-45338, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821
golang.org/x/text v0.23.0 v0.39.0 CVE-2026-56852
github.com/antchfx/xpath v1.1.10 v1.3.6 CVE-2026-32287
github.com/antchfx/jsonquery v1.1.4 v1.3.7 (parent of vulnerable xpath)
github.com/antchfx/xmlquery v1.3.1 v1.5.1 (parent of vulnerable xpath)

Makefile change: Removed the obsolete x/crypto@v0.0.0-20191206172530 (Dec 2019) vendor override. This ancient version was incompatible with grpc v1.82.1 and is no longer needed — x/crypto v0.52.0 retains ssh/terminal and RevokedCertificates backward compatibility.

CodeQL fix needed (separate PR): grpc v1.82.1 and x/crypto v0.52.0 require go >= 1.25.0, but the CodeQL workflow uses the runner's default Go 1.24.x. A reviewer with workflow scope should add to .github/workflows/codeql-analysis.yml before the Initialize CodeQL step:

- name: Set up Go
  uses: actions/setup-go@v5
  with:
    go-version: '1.25'

How to verify it

trivy fs . --severity CRITICAL,HIGH  # should show 0 CRITICAL
make all                               # ensure build succeeds

- google.golang.org/grpc v1.69.2 -> v1.82.1 (CVE-2026-33186, GHSA-hrxh-6v49-42gf)
- golang.org/x/crypto v0.36.0 -> v0.52.0 (CVE-2024-45337, CVE-2025-22869, CVE-2026-39828-39832)
- golang.org/x/net v0.38.0 -> v0.55.0 (CVE-2023-39325, CVE-2024-45338, CVE-2026-25681, CVE-2026-33814)
- golang.org/x/text v0.23.0 -> v0.39.0 (CVE-2026-56852)
- antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287)
- antchfx/jsonquery v1.1.4 -> v1.3.7 (parent of vulnerable xpath)
- antchfx/xmlquery v1.3.1 -> v1.5.1 (parent of vulnerable xpath)
Also update replace directives for grpc and crypto to match.

Signed-off-by: qiluo <qiluo@microsoft.com>
Copilot AI lite review requested due to automatic review settings August 6, 2026 23:50
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@mssonicbld

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates sonic-gnmi’s Go module dependencies to remediate CRITICAL/HIGH CVEs identified by Trivy, primarily by upgrading core golang.org/x/* libraries and google.golang.org/grpc.

Changes:

  • Upgraded key security-relevant dependencies (notably grpc, x/crypto, x/net, x/text) and refreshed indirect module selections via go mod tidy.
  • Updated replace directives for x/crypto and grpc to match the upgraded versions.
  • Introduced additional indirect dependency updates pulled in by the newer gRPC ecosystem.
Suppressed comments (2)

go.mod:83

  • The replace directive forces golang.org/x/sys to v0.26.0, which will override the module graph (currently selecting v0.45.0) and effectively downgrade x/sys. This can negate security upgrades and cause subtle incompatibilities with newer gRPC/transitives; align the replace version with the selected requirement or drop the replace if no longer needed.
	golang.org/x/crypto => golang.org/x/crypto v0.52.0
	golang.org/x/sys => golang.org/x/sys v0.26.0
	google.golang.org/grpc => google.golang.org/grpc v1.82.1

go.mod:84

  • The replace directive pins google.golang.org/protobuf to v1.34.1, which overrides the direct require on v1.36.11 and will silently downgrade protobuf at build time. This undermines the stated dependency upgrade intent and may reintroduce fixed CVEs; update/remove the replace so it matches the required version.
	google.golang.org/grpc => google.golang.org/grpc v1.82.1
	google.golang.org/protobuf => google.golang.org/protobuf v1.34.1

Comment thread go.mod
github.com/golang/glog v1.2.4
github.com/golang/mock v1.6.0
github.com/golang/glog v1.2.5
github.com/golang/mock v1.7.0-rc.1
Comment thread go.mod
Comment on lines 78 to 80
// Glog patch needs to be updated to remove this.
github.com/golang/glog => github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
github.com/openconfig/gnmi => github.com/openconfig/gnmi v0.0.0-20200617225440-d2b4e6a45802
Update replace directives so they no longer downgrade dependencies:
- golang.org/x/sys v0.26.0 -> v0.45.0 (matches go mod tidy selection)
- google.golang.org/protobuf v1.34.1 -> v1.36.11 (matches require)

Signed-off-by: qiluo <qiluo@microsoft.com>
@mssonicbld

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

The Makefile previously downloaded x/crypto v0.0.0-20191206172530-e9b2fee46413
(Dec 2019) and replaced the vendored modern crypto before building gnmi CLI
tools, then restored the modern crypto afterward. This override is incompatible
with grpc v1.82.1 which uses crypto APIs added after 2019.

The override is no longer needed because:
- x/crypto v0.52.0 retains ssh/terminal (used by gnmi_cli)
- x/crypto v0.52.0 retains RevokedCertificates as a deprecated alias
  (used by the 0002-Fix-advance-tls-build-with-go-119.patch)

Use the already-vendored modern crypto for all builds.

Signed-off-by: qiluo <qiluo@microsoft.com>
@mssonicbld

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

grpc v1.82.1 and x/sys v0.45.0 require go >= 1.25.0 which breaks CodeQL
(uses Go 1.24.13). Use the highest versions that still fix CVE-2026-33186
while requiring only go 1.24.x:

- google.golang.org/grpc v1.82.1 -> v1.80.0 (go 1.24.0, fixes CVE-2026-33186)
- golang.org/x/crypto v0.52.0 -> v0.48.0 (go 1.24.0, fixes CVE-2024-45337+)
- golang.org/x/net v0.55.0 -> v0.49.0 (go 1.24.0)
- golang.org/x/text v0.39.0 -> v0.34.0 (go 1.24.0)
- golang.org/x/sys v0.45.0 -> v0.40.0 (go 1.24.0)
Update replace directives accordingly.

Signed-off-by: qiluo <qiluo@microsoft.com>
@mssonicbld

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

grpc v1.82.1 requires go >= 1.25.0. The CodeQL workflow needs to be updated
separately to add 'setup-go: 1.25' step (requires 'workflow' OAuth scope).
That change is tracked in the PR description.

Signed-off-by: qiluo <qiluo@microsoft.com>
@mssonicbld

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

@qiluo-msft

Copy link
Copy Markdown
Collaborator Author

Superseded by #743 with email removed from commit messages.

@qiluo-msft qiluo-msft closed this Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants