From c294f3e12b5dde96a2394ef290ff3fe295a1bccf Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Wed, 9 Sep 2026 09:20:31 +0000 Subject: [PATCH 1/2] Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 The dev chart scan 34330594840 reports CVE-2026-84445 (HIGH, both scanners) against google.golang.org/grpc v1.83.1 in quay.io/stackstate/stackstate-k8s-process-agent:d1ca2bd2. Note the direction: v1.83.1 is what the previous bump moved this repository up to for CVE-2026-84304, and v1.83.1 is now itself affected, so this is a follow-on rather than a repeat. OSV confirms the scanner lead: GHSA-2v4p-qf9q-27wj has ranges introduced 0 / fixed 1.82.2 and introduced 1.83.0 / fixed 1.83.2, so v1.83.2 is the fix on the line this repository is already on. Neither v1.83.2 nor the x/net v0.58.0 it requires has any OSV entry. golang.org/x/net moves v0.57.0 -> v0.58.0 because grpc v1.83.2's own go.mod requires it; nothing else in the graph changed. The advisory is scoped to gRPC-Go xDS servers crashing on requests missing :authority and Host headers. No google.golang.org/grpc/xds package is linked here - 66 grpc packages are reachable from ./cmd/... and none of them is under xds - so the crash path is not present. It is bumped anyway because a compatible patch release exists, which is cheaper and more durable than a suppression. Validation: go mod verify passes; go build and go test with the release tag set (kubelet kubeapiserver linux cri containerd linux_bpf) leave exactly the two failures a bare checkout already produces on master, undefined runtime.Tracer and runtime.RuntimeSecurity in the datadog-agent upstream eBPF compile assets that the CI prebuild step generates. config, model, pkg/kube, pkg/pods and test-server pass. scripts/verify-openpgp-absent.sh still reports openpgp absent from 1886 packages. The other 38 rows the same scan attributes to this repository are base-image RPMs, not source work. BCI.dockerfile pins no package versions, and the SLE_BCI channel today resolves exactly the fixed version for every one of them, so they clear on the rebuild this commit triggers. --- go.mod | 4 ++-- go.sum | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index f2ef1725..b4055eb4 100644 --- a/go.mod +++ b/go.mod @@ -148,7 +148,7 @@ require ( go.opencensus.io v0.24.0 // indirect golang.org/x/crypto v0.56.0 // indirect golang.org/x/mod v0.38.0 // indirect - golang.org/x/net v0.57.0 // indirect + golang.org/x/net v0.58.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/text v0.41.0 // indirect @@ -156,7 +156,7 @@ require ( golang.org/x/tools v0.48.0 // indirect golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 // indirect - google.golang.org/grpc v1.83.1 + google.golang.org/grpc v1.83.2 google.golang.org/protobuf v1.36.11 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index 88326f6f..83f1af82 100644 --- a/go.sum +++ b/go.sum @@ -1793,6 +1793,8 @@ golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190130055435-99b60b757ec1/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -2082,6 +2084,8 @@ google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/grpc/examples v0.0.0-20221020162917-9127159caf5a h1:p51n6zkL483uumoZhCSGtHCem9kDeU05G5jX/wYI9gw= google.golang.org/grpc/examples v0.0.0-20221020162917-9127159caf5a/go.mod h1:gxndsbNG1n4TZcHGgsYEfVGnTxqfEdfiDv6/DADXX9o= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From c4840469c675351ab1075f8a8469027828635e51 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Thu, 10 Sep 2026 16:43:31 +0000 Subject: [PATCH 2/2] Bump containerd to v1.7.35 for CVE-2026-53495 [skip ci] Scan 34489623699 attempt 1 adds the CRI ExecSync goroutine leak to this repository's findings. Upstream GHSA-7jxh-36q5-gcqv confirms v1.7.35 fixes the existing v1.7 line. Only containerd changes; the separately versioned API module remains v1.8.0. The release dependency graph does not include containerd/pkg/cri, but a compatible patch avoids carrying another suppression. Rebased the preceding gRPC fix onto master c028f242, which includes both reviewed prebuild fixes from #280. Keep #281's unrelated checksum cleanup separate. The GO-2026-5932 exception is unchanged and remains a human decision on cve-reporter#27. Validation: go mod verify; release-tag dependency resolution and OpenPGP absence guard (1886 packages); git diff --check. Skip automatic PR CI because that event publishes images. Dispatch ci.yml on this exact branch head for dual-architecture build, test, smoke and scanners with publication skipped, as required for this task. Tracking: https://github.com/StackVista/cve-reporter/issues/69 --- go.mod | 2 +- go.sum | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/go.mod b/go.mod index b4055eb4..26800fc9 100644 --- a/go.mod +++ b/go.mod @@ -67,7 +67,7 @@ require ( github.com/Microsoft/hcsshim v0.12.9 // indirect github.com/awalterschulze/gographviz v2.0.3+incompatible // indirect github.com/beorn7/perks v1.0.1 // indirect - github.com/containerd/containerd v1.7.33 // indirect + github.com/containerd/containerd v1.7.35 // indirect github.com/containerd/continuity v0.4.4 // indirect github.com/containerd/fifo v1.1.0 // indirect github.com/containerd/ttrpc v1.2.7 // indirect diff --git a/go.sum b/go.sum index 83f1af82..a14e8d9c 100644 --- a/go.sum +++ b/go.sum @@ -572,6 +572,8 @@ github.com/containerd/cgroups/v3 v3.0.4 h1:2fs7l3P0Qxb1nKWuJNFiwhp2CqiKzho71DQkD github.com/containerd/cgroups/v3 v3.0.4/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins= github.com/containerd/containerd v1.7.33 h1:iAkYGC/ifR/V+0eR4iXWHNGYUF0DF2PmGV5iz4Irj5M= github.com/containerd/containerd v1.7.33/go.mod h1:gSbSCVjPCdkfJCjyrzz7aRC+xFlqVbatNpfHfVCYGUM= +github.com/containerd/containerd v1.7.35 h1:7AU2T1qI2OdNBmKkreWZ7kASHUNFItN5Hgejd9sY938= +github.com/containerd/containerd v1.7.35/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0= github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc= github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=