OCPBUGS-30431: CVE-2024-24786: bump pkg golang protobuf

[martinkennelly]

Executed:
$ go get -u github.com/golang/protobuf@v1.5.4
$ go mod vendor

Unsure if this CVE is actually exploitable - bumping github.com/golang/protobuf from v1.5.3 -> v1.5.4

See: https://bugzilla.redhat.com/show_bug.cgi?id=2268046#c19

[openshift-ci-robot]

@martinkennelly: This pull request references Jira Issue OCPBUGS-30431, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @zhaozhanqi

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Executed:
$ go get -u github.com/golang/protobuf@v1.5.4
$ go mod vendor

Unsure if this CVE is actually exploitable - bumping github.com/golang/protobuf from v1.5.3 -> v1.5.4

See: https://bugzilla.redhat.com/show_bug.cgi?id=2268046#c19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[danwinship]

/lgtm

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD f4cdaa2 and 2 for PR HEAD 64eb330 in total

[danwinship]

`go.sum` content is incorrect - did you run `go mod tidy`?

[martinkennelly]

`go.sum` content is incorrect - did you run `go mod tidy`?

🤦

Looks like I didnt...

[martinkennelly]

Very strange. Running Go mod vendor locally produces no changes to the vendor directory including if i delete that directory and recreate it. The following was added when i exec go mod vendor even though this component wasnt upgraded:

diff --git a/vendor/github.com/containernetworking/plugins/plugins/ipam/host-local/backend/disk/backend.go b/vendor/github.com/containernetworking/plugins/plugins/ipam/host-local/backend/disk/backend.go
index 350f1b501..82c3a8a99 100644
--- a/vendor/github.com/containernetworking/plugins/plugins/ipam/host-local/backend/disk/backend.go
+++ b/vendor/github.com/containernetworking/plugins/plugins/ipam/host-local/backend/disk/backend.go
@@ -56,7 +56,7 @@ func New(network, dataDir string) (*Store, error) {
 
 func (s *Store) Reserve(id string, ip net.IP, rangeID string) (bool, error) {
        fname := filepath.Join(s.dataDir, ip.String())
-       f, err := os.OpenFile(fname, os.O_RDWR|os.O_EXCL|os.O_CREATE, 0600)
+       f, err := os.OpenFile(fname, os.O_RDWR|os.O_EXCL|os.O_CREATE, 0644)
        if os.IsExist(err) {
                return false, nil
        }
@@ -74,7 +74,7 @@ func (s *Store) Reserve(id string, ip net.IP, rangeID string) (bool, error) {
        }
        // store the reserved ip in lastIPFile
        ipfile := filepath.Join(s.dataDir, lastIPFilePrefix+rangeID)
-       err = ioutil.WriteFile(ipfile, []byte(ip.String()), 0600)
+       err = ioutil.WriteFile(ipfile, []byte(ip.String()), 0644)
        if err != nil {
                return false, err
        }

[martinkennelly]

/hold

[danwinship]

@martinkennelly there's a local patch to containernetworking/plugins to fix a CVE. make update-deps-overrides knows how to deal with it but go mod vendor doesn't.

anyway, current state is correct
/hold cancel
/lgtm

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 0197d0d and 2 for PR HEAD 878c919 in total

[martinkennelly]

"Rebased" due to conflicts - executed same commands on top of HEAD as described in OP.

[danwinship]

executed same commands on top of HEAD as described in OP

hm, apparently you got the magic wrong this time; you need to revert the change to vendor/github.com/containernetworking/plugins/plugins/ipam/host-local/backend/disk/backend.go (and then you can run make verify-deps to check the result)

[danwinship]

/retest-required
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, martinkennelly

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [danwinship]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 0197d0d and 2 for PR HEAD af7fcb7 in total

[openshift-ci]

@martinkennelly: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	af7fcb7	link	false	/test security

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci-robot]

@martinkennelly: Jira Issue OCPBUGS-30431: All pull requests linked via external trackers have merged:

• openshift/sdn#620

Jira Issue OCPBUGS-30431 has been moved to the MODIFIED state.

In response to this:

Executed:
$ go get -u github.com/golang/protobuf@v1.5.4
$ go mod vendor

Unsure if this CVE is actually exploitable - bumping github.com/golang/protobuf from v1.5.3 -> v1.5.4

See: https://bugzilla.redhat.com/show_bug.cgi?id=2268046#c19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-node-container-v4.17.0-202404302014.p0.g5b658c4.assembly.stream.el9 for distgit ose-sdn.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-05-01-111315