v2.6.1 is affected by CVE-2022-32149

[knopt]

The latest release is affected by vulnerability CVE-2022-32149 which is marked as high severity. The issue is being addressed in other parts of Kubernetes as well, see: https://github.com/kubernetes/kubernetes/pull/112989/files

My proposed solution is to add the following directive to go.mod:

replace golang.org/x/text => golang.org/x/text v0.4.0

I'd be happy to submit a PR when the solution is agreed upon.

[mauriciopoppe]

Thanks for raising this issue, we could do that or sync master's go.mod https://github.com/kubernetes-csi/node-driver-registrar/blob/master/go.mod#L42 to release-2.6

[knopt]

The problem is that the node-driver-registrar master branch has transitive dependencies on golang.org/x/text <v0.3.8. You can see them by running:

$ go mod graph | grep golang.org/x/text
# or
$ cat go.sum | grep golang.org/x/text

replace directive will replace them all. Alternative would be to make every node-driver-registrar dependency to not have any transitive dependencies on affected golang.org/x/text versions which seems unfeasible. Let me know your thoughts.

[mauriciopoppe]

I see, yes the replace sounds good, you could create a PR against master and then use https://github.com/kubernetes/kubernetes/blob/master/hack/cherry_pick_pull.sh to cherrypick it to release-2.6

[knopt]

This is fixed by #243

[knopt]

I've created #255 to cherrypick #243 into 2.6.

[knopt]

Thank you for merging the MR @msau42 . Is is possible to release 2.6.3 so container without discovered vulns is available?

[mauriciopoppe]

/assign

@knopt Thanks for the updates in the branches to fix vuln issues.

Yes, I'll create a release for v2.6.2 (for kubernetes 1.25) and also v2.7.0 (new release branch from master for kubernetes 1.26)