OCPBUGS-21009: UPSTREAM: <carry>: openshift: Address CVE-2023-39325

[gcs278]

Backport of #101 for 4.11

Fix OCPBUGS-21009 by addressing CVE-2023-39325

go get golang.org/x/net@v0.17.0
go mod tidy && go mod vendor

[openshift-ci]

@gcs278: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[Miciah]

Thanks!
/approve
/lgtm
/label backport-risk-assessed

[openshift-ci-robot]

@gcs278: This pull request references Jira Issue OCPBUGS-21009, which is invalid:

• expected dependent Jira Issue OCPBUGS-21023 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is New instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Backport of #101 for 4.11

Fix OCPBUGS-21009 by addressing CVE-2023-39325

go get golang.org/x/net@v0.17.0
go mod tidy && go mod vendor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[melvinjoseph86]

/label cherry-pick-approved

[melvinjoseph86]

melvinjoseph@mjoseph-mac Downloads % oc get clusterversion
NAME      VERSION                                                   AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.11.0-0.ci.test-2023-10-25-063937-ci-ln-ywzxtvb-latest   True        False         6m19s   Cluster version is 4.11.0-0.ci.test-2023-10-25-063937-ci-ln-ywzxtvb-latest
melvinjoseph@mjoseph-mac Downloads %  oc get po -n openshift-dns
NAME                  READY   STATUS    RESTARTS   AGE
dns-default-795jt     2/2     Running   0          17m
dns-default-9qwzj     2/2     Running   0          17m
dns-default-crwtl     2/2     Running   0          20m
dns-default-fft2s     2/2     Running   0          17m
dns-default-pfxgx     2/2     Running   0          20m
dns-default-wjhs9     2/2     Running   0          20m
node-resolver-2csxn   1/1     Running   0          18m
node-resolver-mpjk8   1/1     Running   0          20m
node-resolver-qjg69   1/1     Running   0          20m
node-resolver-shv88   1/1     Running   0          20m
node-resolver-tb5qf   1/1     Running   0          18m
node-resolver-zmfhz   1/1     Running   0          18m
melvinjoseph@mjoseph-mac Downloads %  oc rsync -n openshift-dns dns-default-795jt :/usr/bin/coredns .
error: only SOURCE_DIR and POD:DESTINATION_DIR should be specified as arguments
See 'oc rsync -h' for help and examples
melvinjoseph@mjoseph-mac Downloads %  oc rsync -n openshift-dns dns-default-795jt:/usr/bin/coredns . 
receiving file list ... done
coredns



strings ./coredns >> coredns.txt

sent 38 bytes  received 68452810 bytes  2583126.34 bytes/sec
total size is 68436014  speedup is 1.00
Defaulted container "dns" out of: dns, kube-rbac-proxy
melvinjoseph@mjoseph-mac Downloads % 
melvinjoseph@mjoseph-mac Downloads % 
melvinjoseph@mjoseph-mac Downloads % 
melvinjoseph@mjoseph-mac Downloads % strings ./coredns >> coredns.txt
melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.14.0" coredns.txt
golang.org/x/crypto
v0.14.0
--
golang.org/x/crypto
v0.14.0
melvinjoseph@mjoseph-mac Downloads %  grep -B1 "v0.8.0" coredns.txt
melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.17.0" coredns.txt
golang.org/x/net
v0.17.0
--
golang.org/x/net
v0.17.0
melvinjoseph@mjoseph-mac Downloads %  grep -B1 "v0.13.0" coredns.txt
golang.org/x/sys
v0.13.0
golang.org/x/term
v0.13.0
golang.org/x/text
v0.13.0
--
golang.org/x/sys
v0.13.0
golang.org/x/term
v0.13.0
golang.org/x/text
v0.13.0
melvinjoseph@mjoseph-mac Downloads % grep -B1 "v0.6.0" coredns.txt
github.com/Azure/go-autorest/tracing
v0.6.0
--
github.com/Azure/go-autorest/tracing
v0.6.0

[melvinjoseph86]

/label qe-approved

[openshift-ci-robot]

@gcs278: This pull request references Jira Issue OCPBUGS-21009, which is invalid:

• expected dependent Jira Issue OCPBUGS-21023 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Backport of #101 for 4.11

Fix OCPBUGS-21009 by addressing CVE-2023-39325

go get golang.org/x/net@v0.17.0
go mod tidy && go mod vendor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[gcs278]

/jira refresh

[openshift-ci-robot]

@gcs278: This pull request references Jira Issue OCPBUGS-21009, which is valid.

6 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.11.z) matches configured target version for branch (4.11.z)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
• dependent bug Jira Issue OCPBUGS-21023 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-21023 targets the "4.12.z" version, which is one of the valid target versions: 4.12.0, 4.12.z
• bug has dependents

Requesting review from QA contact:
/cc @melvinjoseph86

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: melvinjoseph86.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

@gcs278: This pull request references Jira Issue OCPBUGS-21009, which is valid.

6 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.11.z) matches configured target version for branch (4.11.z)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
• dependent bug Jira Issue OCPBUGS-21023 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-21023 targets the "4.12.z" version, which is one of the valid target versions: 4.12.0, 4.12.z
• bug has dependents

Requesting review from QA contact:
/cc @melvinjoseph86

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@gcs278: Jira Issue OCPBUGS-21009: All pull requests linked via external trackers have merged:

• openshift/coredns#104

Jira Issue OCPBUGS-21009 has been moved to the MODIFIED state.

In response to this:

Backport of #101 for 4.11

Fix OCPBUGS-21009 by addressing CVE-2023-39325

go get golang.org/x/net@v0.17.0
go mod tidy && go mod vendor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-merge-robot]

Fix included in accepted release 4.11.0-0.nightly-2023-10-31-013328