fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs - #742
Closed
qiluo-msft wants to merge 6 commits into
Closed
fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs#742qiluo-msft wants to merge 6 commits into
qiluo-msft wants to merge 6 commits into
Conversation
- google.golang.org/grpc v1.69.2 -> v1.82.1 (CVE-2026-33186, GHSA-hrxh-6v49-42gf) - golang.org/x/crypto v0.36.0 -> v0.52.0 (CVE-2024-45337, CVE-2025-22869, CVE-2026-39828-39832) - golang.org/x/net v0.38.0 -> v0.55.0 (CVE-2023-39325, CVE-2024-45338, CVE-2026-25681, CVE-2026-33814) - golang.org/x/text v0.23.0 -> v0.39.0 (CVE-2026-56852) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287) - antchfx/jsonquery v1.1.4 -> v1.3.7 (parent of vulnerable xpath) - antchfx/xmlquery v1.3.1 -> v1.5.1 (parent of vulnerable xpath) Also update replace directives for grpc and crypto to match. Signed-off-by: qiluo <qiluo@microsoft.com>
Signed-off-by: qiluo <qiluo@microsoft.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates sonic-gnmi’s Go module dependencies to remediate CRITICAL/HIGH CVEs identified by Trivy, primarily by upgrading core golang.org/x/* libraries and google.golang.org/grpc.
Changes:
- Upgraded key security-relevant dependencies (notably
grpc,x/crypto,x/net,x/text) and refreshed indirect module selections viago mod tidy. - Updated
replacedirectives forx/cryptoandgrpcto match the upgraded versions. - Introduced additional indirect dependency updates pulled in by the newer gRPC ecosystem.
Suppressed comments (2)
go.mod:83
- The
replacedirective forcesgolang.org/x/systov0.26.0, which will override the module graph (currently selectingv0.45.0) and effectively downgradex/sys. This can negate security upgrades and cause subtle incompatibilities with newer gRPC/transitives; align thereplaceversion with the selected requirement or drop thereplaceif no longer needed.
golang.org/x/crypto => golang.org/x/crypto v0.52.0
golang.org/x/sys => golang.org/x/sys v0.26.0
google.golang.org/grpc => google.golang.org/grpc v1.82.1
go.mod:84
- The
replacedirective pinsgoogle.golang.org/protobuftov1.34.1, which overrides the directrequireonv1.36.11and will silently downgrade protobuf at build time. This undermines the stated dependency upgrade intent and may reintroduce fixed CVEs; update/remove thereplaceso it matches the required version.
google.golang.org/grpc => google.golang.org/grpc v1.82.1
google.golang.org/protobuf => google.golang.org/protobuf v1.34.1
| github.com/golang/glog v1.2.4 | ||
| github.com/golang/mock v1.6.0 | ||
| github.com/golang/glog v1.2.5 | ||
| github.com/golang/mock v1.7.0-rc.1 |
Comment on lines
78
to
80
| // Glog patch needs to be updated to remove this. | ||
| github.com/golang/glog => github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b | ||
| github.com/openconfig/gnmi => github.com/openconfig/gnmi v0.0.0-20200617225440-d2b4e6a45802 |
Update replace directives so they no longer downgrade dependencies: - golang.org/x/sys v0.26.0 -> v0.45.0 (matches go mod tidy selection) - google.golang.org/protobuf v1.34.1 -> v1.36.11 (matches require) Signed-off-by: qiluo <qiluo@microsoft.com>
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
The Makefile previously downloaded x/crypto v0.0.0-20191206172530-e9b2fee46413 (Dec 2019) and replaced the vendored modern crypto before building gnmi CLI tools, then restored the modern crypto afterward. This override is incompatible with grpc v1.82.1 which uses crypto APIs added after 2019. The override is no longer needed because: - x/crypto v0.52.0 retains ssh/terminal (used by gnmi_cli) - x/crypto v0.52.0 retains RevokedCertificates as a deprecated alias (used by the 0002-Fix-advance-tls-build-with-go-119.patch) Use the already-vendored modern crypto for all builds. Signed-off-by: qiluo <qiluo@microsoft.com>
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
grpc v1.82.1 and x/sys v0.45.0 require go >= 1.25.0 which breaks CodeQL (uses Go 1.24.13). Use the highest versions that still fix CVE-2026-33186 while requiring only go 1.24.x: - google.golang.org/grpc v1.82.1 -> v1.80.0 (go 1.24.0, fixes CVE-2026-33186) - golang.org/x/crypto v0.52.0 -> v0.48.0 (go 1.24.0, fixes CVE-2024-45337+) - golang.org/x/net v0.55.0 -> v0.49.0 (go 1.24.0) - golang.org/x/text v0.39.0 -> v0.34.0 (go 1.24.0) - golang.org/x/sys v0.45.0 -> v0.40.0 (go 1.24.0) Update replace directives accordingly. Signed-off-by: qiluo <qiluo@microsoft.com>
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
grpc v1.82.1 requires go >= 1.25.0. The CodeQL workflow needs to be updated separately to add 'setup-go: 1.25' step (requires 'workflow' OAuth scope). That change is tracked in the PR description. Signed-off-by: qiluo <qiluo@microsoft.com>
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
Author
|
Superseded by #743 with email removed from commit messages. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Trivy CVE scan identified multiple CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-gnmi.
How I did it
Updated
go.mod,Makefile, and regeneratedgo.sumviago mod tidywith the following version bumps:google.golang.org/grpcgolang.org/x/cryptogolang.org/x/netgolang.org/x/textgithub.com/antchfx/xpathgithub.com/antchfx/jsonquerygithub.com/antchfx/xmlqueryMakefile change: Removed the obsolete
x/crypto@v0.0.0-20191206172530(Dec 2019) vendor override. This ancient version was incompatible with grpc v1.82.1 and is no longer needed —x/crypto v0.52.0retainsssh/terminalandRevokedCertificatesbackward compatibility.CodeQL fix needed (separate PR): grpc v1.82.1 and x/crypto v0.52.0 require
go >= 1.25.0, but the CodeQL workflow uses the runner's default Go 1.24.x. A reviewer withworkflowscope should add to.github/workflows/codeql-analysis.ymlbefore theInitialize CodeQLstep:How to verify it