BUG 2312515: CVE-2024-6104 cephcsi-container: go-retryablehttp: url might write sensitive information to log file #381

iPraveenParihar · 2024-09-16T08:39:21Z

Bumps github.com/hashicorp/go-retryablehttp from 0.7.1 to 0.7.7.

updated-dependencies:

dependency-name: github.com/hashicorp/go-retryablehttp dependency-type: indirect ...

Signed-off-by: dependabot[bot] [email protected]
(cherry picked from commit 2131a84)

Describe what this PR does

Provide some context for the reviewer

Is there anything that requires special attention

Do you have any questions?

Is the change backward compatible?

Are there concerns around backward compatibility?

Provide any external context for the change, if any.

For example:

Kubernetes links that explain why the change is required
CSI spec related changes/catch-up that necessitates this patch
golang related practices that necessitates this change

Related issues

Mention any github issues relevant to this PR. Adding below line
will help to auto close the issue once the PR is merged.

Fixes: #issue_number

Future concerns

List items that are not part of the PR and do not impact it's
functionality, but are work items that can be taken up subsequently.

Checklist:

Commit Message Formatting: Commit titles and messages follow
guidelines in the developer
guide.
Reviewed the developer guide on Submitting a Pull
Request
Pending release
notes
updated with breaking and/or notable changes for the next major release.
Documentation has been updated, if necessary.
Unit tests have been added, if necessary.
Integration tests have been added, if necessary.

Show available bot commands

These commands are normally not required, but in case of issues, leave any of
the following bot commands in an otherwise empty comment in this PR:

/retest ci/centos/<job-name>: retest the <job-name> after unrelated
failure (please report the failure too!)

openshift-ci · 2024-09-16T08:39:27Z

@iPraveenParihar: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "ODF 4.16.2" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.7.1 to 0.7.7. - [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md) - [Commits](hashicorp/go-retryablehttp@v0.7.1...v0.7.7) --- updated-dependencies: - dependency-name: github.com/hashicorp/go-retryablehttp dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> (cherry picked from commit 2131a84)

nixpanic · 2024-09-19T11:08:05Z

/hold

Before fixing 4.12, make sure all newer versions have the fixes too already. We have templates for backport PRs, see the redhat/README.md.

iPraveenParihar · 2024-09-23T06:24:47Z

@nixpanic, backport PRs were already created & merged to newer versions (4.17 to 4.13).

nixpanic · 2024-09-26T07:21:40Z

Thanks, in the future, use the backport tempate for the PR, so that it is clear the whole process is followed.
As you mentioned other versions had their backports already, I was able to find them with https://github.com/red-hat-storage/ceph-csi/pulls?q=is%3Apr+CVE-2024-6104+

/unhold

iPraveenParihar · 2024-10-07T06:45:05Z

I have cherry-picked around 6 commits related to lint failures. And not sure still how many needed to make lint CI green ✅.
@Madhu-1, In CVE PRs do we really need to fix the lint failures? We'll be just adding more and more commits not related to CVE as we Backport on lower versions.

WDYT?

Madhu-1 · 2024-10-07T07:43:21Z

In most of the cases we will try to fix it but not like we pick more commits and it's not getting fixed like this, we can make an exception for pretty older releases and do what is only required and get it merged.

nixpanic · 2024-10-08T12:54:20Z

Creating the test container-image seems to be problematic. Can you check if a fix for that can be backported as well? I can be as part of this PR, so that CI jobs provide some confidence of the build.

https://github.com/red-hat-storage/ceph-csi/actions/runs/11211368084/job/31160100707?pr=381#step:3:824

nixpanic · 2024-10-08T12:56:43Z

@iPraveenParihar , you probably need ceph#3540 to get the CI to pass

GitHub Workflows fail installing Helm if the `openssl` package is not available. Fedora 36 installs `openssl` by default, Fedora 37 does not. Signed-off-by: Niels de Vos <[email protected]> (cherry picked from commit 774beef)

Since CentOS Stream 8 is EOL, this commit updates the config to use vault.centos.org for CentOS Stream 8. This should be removed once the base image (ceph) is updated to a version with a newer CentOS. Signed-off-by: Praveen M <[email protected]> (cherry picked from commit 5809628)

nixpanic · 2024-10-08T15:43:45Z

Thanks! CI jobs that are really required pass now.

/approve
/lgtm

openshift-ci · 2024-10-08T15:43:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: iPraveenParihar, nixpanic

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [nixpanic]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2024-10-09T01:00:22Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-09T01:00:26Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-10T01:01:15Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-10T01:01:19Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-11T01:00:33Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-11T01:00:38Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-12T01:00:31Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-12T01:00:35Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-13T01:00:32Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-13T01:00:35Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-14T01:00:37Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-14T01:00:42Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-15T01:00:30Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-15T01:00:35Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-16T01:02:42Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-16T01:02:47Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-17T01:00:29Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-17T01:00:34Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-18T01:01:21Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-18T01:01:25Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-19T01:00:51Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-19T01:00:56Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-20T01:00:18Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-20T01:00:23Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-21T01:00:28Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-21T01:00:33Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-10-22T01:00:35Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci · 2024-10-22T01:00:40Z

@openshift-bot: This pull request references Bugzilla bug 2312515, which is invalid:

expected the bug to target the "ODF 4.12.15" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci bot added do-not-merge/work-in-progress bugzilla/severity-medium bugzilla/invalid-bug labels Sep 16, 2024

iPraveenParihar force-pushed the bz/2312515 branch 2 times, most recently from b235408 to d340889 Compare September 18, 2024 10:21

openshift-ci bot added the do-not-merge/hold label Sep 19, 2024

openshift-ci bot removed the do-not-merge/hold label Sep 26, 2024

iPraveenParihar force-pushed the bz/2312515 branch from b7f1f21 to d796f8a Compare October 7, 2024 08:12

iPraveenParihar marked this pull request as ready for review October 7, 2024 08:12

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 7, 2024

iPraveenParihar requested review from Madhu-1 and nixpanic and removed request for Madhu-1 October 7, 2024 14:29

nixpanic and others added 2 commits October 8, 2024 20:22

ci: install openssl for Fedora 37 testing image

bf81a80

GitHub Workflows fail installing Helm if the `openssl` package is not available. Fedora 36 installs `openssl` by default, Fedora 37 does not. Signed-off-by: Niels de Vos <[email protected]> (cherry picked from commit 774beef)

openshift-ci bot assigned nixpanic Oct 8, 2024

openshift-ci bot added the lgtm Code looks good label Oct 8, 2024

openshift-ci bot added the approved Its a good idea label Oct 8, 2024

BUG 2312515: CVE-2024-6104 cephcsi-container: go-retryablehttp: url might write sensitive information to log file #381

Are you sure you want to change the base?

BUG 2312515: CVE-2024-6104 cephcsi-container: go-retryablehttp: url might write sensitive information to log file #381

Conversation

iPraveenParihar commented Sep 16, 2024

Describe what this PR does

Is there anything that requires special attention

Related issues

Future concerns

openshift-ci bot commented Sep 16, 2024

nixpanic commented Sep 19, 2024

iPraveenParihar commented Sep 23, 2024

nixpanic commented Sep 26, 2024

iPraveenParihar commented Oct 7, 2024 • edited Loading

Madhu-1 commented Oct 7, 2024

nixpanic commented Oct 8, 2024

nixpanic commented Oct 8, 2024

nixpanic commented Oct 8, 2024

openshift-ci bot commented Oct 8, 2024

openshift-bot commented Oct 9, 2024

openshift-ci bot commented Oct 9, 2024

openshift-bot commented Oct 10, 2024

openshift-ci bot commented Oct 10, 2024

openshift-bot commented Oct 11, 2024

openshift-ci bot commented Oct 11, 2024

openshift-bot commented Oct 12, 2024

openshift-ci bot commented Oct 12, 2024

openshift-bot commented Oct 13, 2024

openshift-ci bot commented Oct 13, 2024

openshift-bot commented Oct 14, 2024

openshift-ci bot commented Oct 14, 2024

openshift-bot commented Oct 15, 2024

openshift-ci bot commented Oct 15, 2024

openshift-bot commented Oct 16, 2024

openshift-ci bot commented Oct 16, 2024

openshift-bot commented Oct 17, 2024

openshift-ci bot commented Oct 17, 2024

openshift-bot commented Oct 18, 2024

openshift-ci bot commented Oct 18, 2024

openshift-bot commented Oct 19, 2024

openshift-ci bot commented Oct 19, 2024

openshift-bot commented Oct 20, 2024

openshift-ci bot commented Oct 20, 2024

openshift-bot commented Oct 21, 2024

openshift-ci bot commented Oct 21, 2024

openshift-bot commented Oct 22, 2024

openshift-ci bot commented Oct 22, 2024

iPraveenParihar commented Oct 7, 2024 •

edited

Loading