Skip to content

Address CVE-2023-45288 #17703

Closed
Closed
Address CVE-2023-45288#17703
Assignees
henrybear327
Labels
area/securitygood first issuetype/feature

Description

@ivanvc
ivanvc
opened on Apr 4, 2024

What would you like to be added?

CVE-2023-45288 / GO-2024-2687 was recently published. We need to:

Go version bump

Bump golang.org/x/net from 1.22.1 to 1.22.2

Why is this needed?

To improve security and address the CVE. And to keep the Go version up to date.

Activity

  1. ivanvc
    added
    area/security
    type/feature
    on Apr 4, 2024
  2. jmhbnz
    added
    help wanted
    good first issue
    on Apr 4, 2024

  3. henrybear327 commented on Apr 4, 2024

    @henrybear327
    henrybear327
    on Apr 4, 2024
    Contributor

    I can work on it!

  4. ahrtr commented on Apr 4, 2024

    @ahrtr
    ahrtr
    on Apr 4, 2024
    Member

    We also need to update bbolt (including both main and release-1.3) and raft.

  5. rissh commented on Apr 4, 2024

    @rissh
    rissh
    on Apr 4, 2024

    Hello everyone,

    I'm diving into updating dependencies for CVE-2023-45288 / GO-2024-2687. Excited to give it a shot! If anyone wants to join or has advice, let me know.

  6. henrybear327 commented on Apr 4, 2024

    @henrybear327
    henrybear327
    on Apr 4, 2024
    Contributor

    Hello everyone,

    I'm diving into updating dependencies for CVE-2023-45288 / GO-2024-2687. Excited to give it a shot! If anyone wants to join or has advice, let me know.

    Hey @rissh,

    I have already created all the PRs!

  7. 4 remaining items

  8. jmhbnz
    assigned
    henrybear327
    on Apr 4, 2024

  9. henrybear327 commented on Apr 4, 2024

    @henrybear327
    henrybear327
    on Apr 4, 2024
    Contributor

    What would you like to be added?

    CVE-2023-45288 / GO-2024-2687 was recently published. We need to:

    • update main's branch Go version from 1.22.1 to 1.22.2
    • update release-3.5 from 1.21.8 to 1.21.9
    • update release-3.4 from 1.21.8 to 1.21.9
    • update CHANGELOG
    • update main's golang.org/x/net from v0.22.0 to v0.23.0

    The severity hasn't been published yet. So, I'm unsure if we should update golang.org/x/net in release-3.4/3.5. However, it may be a good idea as the govuln check will fail.

    Why is this needed?

    To improve security and address the CVE. And to keep the Go version up to date.

    The vulnerability scan on CI will report an error, thus, the decision is made to also upgrade golang.org/x/net.

    Log extract:

    go: downloading golang.org/x/vuln v1.0.4
go: downloading golang.org/x/mod v0.14.0
go: downloading golang.org/x/tools v0.1[7](https://github.com/etcd-io/etcd/actions/runs/8551422689/job/23430401128#step:6:8).0
go: downloading golang.org/x/sync v0.6.0
Scanning your code and 504 packages across 77 dependent modules for known vulnerabilities...

=== Symbol Results ===

Vulnerability #1: GO-2024-26[8](https://github.com/etcd-io/etcd/actions/runs/8551422689/job/23430401128#step:6:9)7
    HTTP/2 CONTINUATION flood in net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2687
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.22.0
    Fixed in: golang.org/x/net@v0.23.0

  10. ivanvc commented on Apr 4, 2024

    @ivanvc
    ivanvc
    on Apr 4, 2024
    MemberAuthor

    @henrybear327, yes we also need to bump golang.org/x/net.

  11. ivanvc commented on Apr 4, 2024

    @ivanvc
    ivanvc
    on Apr 4, 2024
    MemberAuthor

    @henrybear327, I just saw that you bumped the dependency and Go in tandem. Thanks, I'll update the to-do list from the description.

  12. henrybear327 commented on Apr 4, 2024

    @henrybear327
    henrybear327
    on Apr 4, 2024
    Contributor

    @henrybear327, I just saw that you bumped the dependency and Go in tandem. Thanks, I'll update the to-do list from the description.

    Hey @ivanvc,

    Sorry that I probably should have done it in 2 PRs instead of 1. I will keep that in mind next time! :)

  13. ivanvc commented on Apr 5, 2024

    @ivanvc
    ivanvc
    on Apr 5, 2024
    MemberAuthor

    With all subtasks completed. I'll go ahead and close this issue. Thanks, @henrybear327 and @MrDXY, for working on this 🙇

  14. ivanvc
    closed this as completedon Apr 5, 2024

  15. ivanvc commented on Jun 13, 2024

    @ivanvc
    ivanvc
    on Jun 13, 2024
    MemberAuthor

    Reopening as #17708 only partially addressed the issue.

    @jmhbnz, would we need a new CHANGELOG entry for 3.5 for this?

  16. ivanvc
    reopened this on Jun 13, 2024
  17. ivanvc
    removed
    help wanted
    on Jun 13, 2024

  18. jmhbnz commented on Jun 20, 2024

    @jmhbnz
    jmhbnz
    on Jun 20, 2024
    Member

    Discussed during sig-etcd triage meeting, the work has been completed for this so we can close. We need to push ahead with 3.5.15 to release this.

  19. jmhbnz
    closed this as completedon Jun 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area/securitygood first issuetype/feature

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions